HOMETHREATSSUGARLOADER
APT / THREAT GROUP

SUGARLOADER

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: osx.sugarloader

Threat Analysis

SUGARLOADER is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering
→https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn
→https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/
→https://www.virusbulletin.com/uploads/pdf/conference/vb2024/papers/Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdf

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

osx.sugarloaderSUGARLOADER

External Intelligence

Malpedia: osx.sugarloader

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search SUGARLOADER