N. Korean Hackers ‘Mixing’ macOS Malware Tactics to Evade Detection

The North Korean danger actors powering macOS malware strains these kinds of as RustBucket and KANDYKORN have been noticed “mixing and matching” various components of the two disparate attack chains, leveraging RustBucket droppers to provide KANDYKORN.

The conclusions come from cybersecurity agency SentinelOne, which also tied a 3rd macOS-particular malware known as ObjCShellz to the RustBucket campaign.

RustBucket refers to an activity cluster connected to the Lazarus Team in which a backdoored model of a PDF reader application, dubbed SwiftLoader, is made use of as a conduit to load a future-stage malware prepared in Rust on viewing a specially crafted entice document.

The KANDYKORN campaign, on the other hand, refers to a destructive cyber procedure in which blockchain engineers of an unnamed crypto trade system were being targeted via Discord to initiate a advanced multi-phase attack sequence that led to the deployment of the eponymous whole-featured memory resident distant accessibility trojan.

The third piece of the attack puzzle is ObjCShellz, which Jamf Risk Labs disclosed previously this thirty day period as a later on-phase payload that acts as a remote shell that executes shell instructions despatched from the attacker server.

Even more evaluation of these strategies by SentinelOne has now shown that the Lazarus Team is using SwiftLoader to distribute KANDYKORN, corroborating a current report from Google-owned Mandiant about how diverse hacker groups from North Korea are more and more borrowing every other’s practices and applications.

“The DPRK’s cyber landscape has progressed to a streamlined group with shared tooling and concentrating on initiatives,” Mandiant pointed out. “This flexible approach to tasking will make it tricky for defenders to track, attribute, and thwart destructive actions, although enabling this now collaborative adversary to move stealthily with better speed and adaptability.”

This involves the use of new variants of the SwiftLoader stager that purports to be an executable named EdoneViewer but, in reality, contacts an actor-controlled domain to most likely retrieve the KANDYKORN RAT based on overlaps in infrastructure and the practices employed.

The disclosure arrives as the AhnLab Security Unexpected emergency Reaction Middle (ASEC) implicated Andariel – a subgroup inside of Lazarus – to cyber assaults exploiting a security flaw in Apache ActiveMQ (CVE-2023-46604, CVSS rating: 10.) to install NukeSped and TigerRAT backdoors.

Discovered this article fascinating? Adhere to us on Twitter  and LinkedIn to go through a lot more unique material we put up.

Some parts of this article are sourced from:
thehackernews.com