Security News > 2021 > February > Malware monsters target Apple’s M1 silicon with ‘Silver Sparrow’
US security consultancy Red Canary says it's found MacOS malware written specifically for the shiny new M1 silicon that Apple created to power its post-Intel Macs.
Red Canary has named the malware "Silver Sparrow" and says it had found its way onto almost 30,000 MacOS devices as of February 17th. Red Canary's post says it has analysed two samples of the malware, one targeting x86 and the other targeting X86 and Apple's own M1 silicon.
The form says both samples "Leverage the macOS Installer JavaScript API to execute suspicious commands." That's not unusual behaviour for a legitimate software installer package, but Red Canary says it's not spotted it in malware before.
The other script is driven by a persistent LaunchAgent that runs it hourly to connect with a server and request more information from whoever controls the malware.
The firm's researchers ran the malware for a week and never saw that request result in a download, leading them to suggest the malware currently lacks a payload. How the malware is distributed remains a mystery, but Red Canary's researchers have divined that it uses resources in AWS and Akamai's content distribution network.
The firms suggests Silver Sparrow's authors therefore appear to have a decent understanding of how working in a public cloud and CDN makes it harder to defend against malware because organisations often have very good reasons to welcome traffic from large public clouds.