Executive Summary
The ServiceNow Red Team has released 'Dark', a specialized Command and Control (C2) agent integrated with the Mythic framework. Operationally proven since 2024, Dark is distinguished by its ability to execute Beacon Object Files (BOFs) entirely in-memory on macOS (including Apple Silicon) and Linux platforms, bypassing traditional disk-based detection mechanisms.
Technically, the agent is written in the Crystal language and utilizes a custom in-memory loader to handle ELF and Mach-O object files, replicating complex linker functions such as global offset table (GOT) management and thunk table bridging for CPU jumps. It implements security features like Two Person Integrity (TPI) for sensitive commands and automated artifact tracking to log indicators of compromise (IOCs) such as file reads and writes.
This development is significant as it brings mature Windows-centric tradecraft—specifically reflective in-memory execution—to macOS and Linux environments where EDR detection for such techniques is often less mature. The ability to load external BOFs dynamically means the initial payload remains lean and difficult to signature while retaining extensive post-exploitation capabilities.