N. Korean Hackers ‘Mixing’ macOS Malware Tactics to Evade Detection

The North Korean risk actors at the rear of macOS malware strains such as RustBucket and KANDYKORN have been noticed “mixing and matching” diverse things of the two disparate attack chains, leveraging RustBucket droppers to supply KANDYKORN.

The findings arrive from cybersecurity firm SentinelOne, which also tied a third macOS-certain malware termed ObjCShellz to the RustBucket marketing campaign.

RustBucket refers to an exercise cluster joined to the Lazarus Team in which a backdoored version of a PDF reader application, dubbed SwiftLoader, is utilized as a conduit to load a subsequent-phase malware composed in Rust upon viewing a specifically crafted lure document.

The KANDYKORN campaign, on the other hand, refers to a destructive cyber procedure in which blockchain engineers of an unnamed crypto exchange platform ended up specific via Discord to initiate a advanced multi-phase attack sequence that led to the deployment of the eponymous full-highlighted memory resident remote accessibility trojan.

The third piece of the attack puzzle is ObjCShellz, which Jamf Menace Labs discovered before this month as a afterwards-stage payload that functions as a distant shell that executes shell commands sent from the attacker server.

Even further evaluation of these strategies by SentinelOne has now shown that the Lazarus Team is utilizing SwiftLoader to distribute KANDYKORN, corroborating a the latest report from Google-owned Mandiant about how diverse hacker groups from North Korea are more and more borrowing each individual other’s strategies and tools.

“The DPRK’s cyber landscape has evolved to a streamlined firm with shared tooling and focusing on attempts,” Mandiant observed. “This adaptable approach to tasking makes it hard for defenders to monitor, attribute, and thwart malicious things to do, though enabling this now collaborative adversary to move stealthily with bigger velocity and adaptability.”

This involves the use of new variants of the SwiftLoader stager that purports to be an executable named EdoneViewer but, in reality, contacts an actor-controlled domain to likely retrieve the KANDYKORN RAT based mostly on overlaps in infrastructure and the ways utilized.

The disclosure will come as the AhnLab Security Unexpected emergency Reaction Heart (ASEC) implicated Andariel – a subgroup in just Lazarus – to cyber attacks exploiting a security flaw in Apache ActiveMQ (CVE-2023-46604, CVSS score: 10.) to put in NukeSped and TigerRAT backdoors.

Observed this posting exciting? Abide by us on Twitter  and LinkedIn to read additional unique information we post.

Some pieces of this post are sourced from:
thehackernews.com