Malware
WAVESHAPER
According to Mandiant, WAVESHAPER is a backdoor written in C++ and packed by an unknown packer that targets macOS.
WAVESHAPER is a macOS malware family operated by UNC1069.
Background
Mandiant reports that WAVESHAPER is a macOS-targeting backdoor written in C++ and wrapped with an unidentified packer. It can fetch and run arbitrary payloads from its command-and-control (C2 or C&C) server, the address of which is supplied through command-line parameters. For talking to the attacker's infrastructure, WAVESHAPER uses the curl library over either HTTP or HTTPS, depending on the command-line argument given. The backdoor additionally operates as a daemon, forking into a background child process detached from the parent session, where it gathers system details and forwards them to the C&C server within an HTTP POST request.
Source: Malpedia (Fraunhofer FKIE).