S1016: MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]

EnterpriseS1016MalwareObject v2.1ModifiedOct 21, 2025, 03:17 UTC (UTC+00:00)

S1016: MacMa describes [MacMa](https://attack.mitre.org/software/S1016) is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. [MacMa](https://attack.mitre.org/software/S1016) has been observed in the wild since November 2021.(Citation: ESET DazzleSpy Jan 2022) [MacMa](https://attack.mitre.org/software/S1016) shares command and control and unique libraries with [MgBot](https://attack.mitre.org/software/S1146) and [Nightdoor](https://attack.mitre.org/software/S1147), indi...

Executive priority

S1016: MacMa is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1016: MacMa by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (macOS), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1016: MacMa appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

MacMa

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques27 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1033	System Owner/User Discovery	MacMa can collect the username from the compromised machine.[1]
Enterprise	T1082	System Information Discovery	MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.[1]
Enterprise	T1095	Non-Application Layer Protocol	MacMa has used a custom JSON-based protocol for its C&C communications.[1]
Enterprise	T1553.002	Code SigningSub-technique	MacMa has been delivered using ad hoc Apple Developer code signing certificates.CitationSentinelOne Macma 2021
Enterprise	T1113	Screen Capture	MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.[1][3]
Enterprise	T1016	System Network Configuration Discovery	MacMa can collect IP addresses from a compromised host.[1]
Enterprise	T1074.001	Local Data StagingSub-technique	MacMa has stored collected files locally before exfiltration.[3]
Enterprise	T1543.001	Launch AgentSub-technique	MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.[1][3]
Enterprise	T1005	Data from Local System	MacMa can collect then exfiltrate files from the compromised system.[1]
Enterprise	T1021	Remote Services	MacMa can manage remote screen sessions.[1]
Enterprise	T1106	Native API	MacMa has used macOS API functions to perform tasks.[1][3]
Enterprise	T1123	Audio Capture	MacMa has the ability to record audio.[3]
Enterprise	T1555.001	KeychainSub-technique	MacMa can dump credentials from the macOS keychain.[1]
Enterprise	T1041	Exfiltration Over C2 Channel	MacMa exfiltrates data from a supplied path over its C2 channel.[1]
Enterprise	T1057	Process Discovery	MacMa can enumerate running processes.[1]
Enterprise	T1070.006	TimestompSub-technique	MacMa has the capability to create and modify file timestamps.[1]
Enterprise	T1571	Non-Standard Port	MacMa has used TCP port 5633 for C2 Communication.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.[1]
Enterprise	T1056.001	KeyloggingSub-technique	MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.[3]CitationSentinelOne MacMa Nov 2021
Enterprise	T1685.006	Clear Linux or Mac System LogsSub-technique	MacMa can clear possible malware traces such as application logs.[1]
Enterprise	T1059.004	Unix ShellSub-technique	MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.[1][3]
Enterprise	T1680	Local Storage Discovery	MacMa can collect information about a compromised computer's disk sizes.[1]
Enterprise	T1553.001	Gatekeeper BypassSub-technique	MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.[1]
Enterprise	T1105	Ingress Tool Transfer	MacMa has downloaded additional files, including an exploit for used privilege escalation.[1][3]
Enterprise	T1573	Encrypted Channel	MacMa has used TLS encryption to initialize a custom protocol for C2 communications.[1]
Enterprise	T1083	File and Directory Discovery	MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.[1]
Enterprise	T1070.004	File DeletionSub-technique	MacMa can delete itself from the compromised computer.[1]

Associated objects

Groups, software, and campaigns

G1034: Daggerfly

Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.[1][2][3][4]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 2.1
Created: May 6, 2022, 01:29 UTC (UTC+00:00)
Modified: Oct 21, 2025, 03:17 UTC (UTC+00:00)
Raw hash: 93b0a80527ee110d...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	2.1	Oct 21, 2025, 03:17 UTC (UTC+00:00)	Current bundle	`93b0a80527ee…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.1	Oct 21, 2025, 03:17 UTC (UTC+00:00)	Older bundle	`93b0a80527ee…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
ESET DazzleSpy Jan 2022
M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.
Open source URL
[2]
Symantec Daggerfly 2024
Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.
Open source URL
[3]
Objective-See MacMa Nov 2021
Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.
Open source URL
[4]
DazzleSpy
(Citation: ESET DazzleSpy Jan 2022)
[5]
OSX.CDDS
(Citation: Objective-See MacMa Nov 2021)
[6]
mitre-attackS1016
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use