Bundlore

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: osx.bundlore

Threat Analysis

Bundlore is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.confiant.com/new-macos-bundlore-loader-analysis-ca16d19c058c

→https://labs.sentinelone.com/resourceful-macos-malware-hides-in-named-fork/

→https://twitter.com/ConfiantIntel/status/1393215825931288580?s=20

→https://www.trendmicro.com/en_hk/research/21/f/nukesped-copies-fileless-code-from-bundlore--leaves-it-unused.html

→https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

SurfBuyerosx.bundloreBundlore

External Intelligence

Malpedia: osx.bundlore

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Bundlore