It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools: Komplex: /Users/kazak/Desktop/Project/komplex XAgent OSX: /Users/kazak/Desktop/Project/XAgentOSX We believe it is possible that Sofacy uses Komplex to download and install the XAgentOSX tool to use its expanded command set on the compromised system