Security News > 2020 > July > Several New Mac Malware Families Attributed to North Korean Hackers
North Korean-linked threat actor Lazarus has been employing at least four new Mac-targeting malware families in recent attacks, SentinelOne security researchers reveal.
Some of the most recent malware families that Lazarus has been leveraging in attacks include the macOS version of the DaclsRAT, and the cross-platform MATA framework, which also targets Windows and Linux systems.
Simultaneously with all three new malware variants, Lazarus has started using a lightweight backdoor written primarily in Objective-C and C and referred to as OSX.Casso, which also has a Windows counterpart.
More recently, Lazarus appears to have been working with two additional malware families, referred to as WatchCat and MediaRemote, based on observed strings for "Com.apple.watchcat.plist" and "MediaRemote.app," with detections increasing rapidly over the past 14 days.
"All of the samples reviewed above have appeared in the last eight to ten weeks and are evidence that threat actors behind the Lazarus group are pursuing several distinct campaigns, using a variety of technologies, and are themselves keeping up-to-date with the Apple platform. These are not actors merely porting Windows malware to macOS, but rather Mac-specific developers deeply invested in writing custom malware for Apple's platform," SentinelOne concludes.
News URL
Related news
- North Korean Hackers Deploy FERRET Malware via Fake Job Interviews on macOS (source)
- North Korean hackers spotted using ClickFix tactic to deliver malware (source)
- North Korean Hackers Target Freelance Developers in Job Scam to Deploy Malware (source)
- Docker Desktop blocked on Macs due to false malware alert (source)
- Russia-Linked Hackers Target Kazakhstan in Espionage Campaign with HATVIBE Malware (source)
- Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer (source)
- Fake Homebrew Google ads target Mac users with malware (source)
- Hacker infects 18,000 "script kiddies" with fake malware builder (source)
- North Korean APT Kimsuky Uses forceCopy Malware to Steal Browser-Stored Credentials (source)
- Hackers exploit SimpleHelp RMM flaws to deploy Sliver malware (source)