Vulnerabilities / Threats

8/23/2018
03:07 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Lazarus Group Builds its First MacOS Malware

This isn't the first time Lazarus Group has infiltrated a cryptocurrency exchange as the hacking team has found new ways to achieve financial gain.

Same goals, new tools: Lazarus Group is targeting cryptocurrency exchanges with macOS malware, a sign the nation-state group is developing attacks for a broader variety of platforms to achieve its goal of financial gain.

This is the first case in which Kaspersky Lab researchers spotted Lazarus Group using malware targeting macOS. It seems the group - believed to be out of North Korea - wants to ensure OS platforms don't interfere with infecting targets, so it's building malware for different operating systems. A version of the same malware tailored for Linux is reportedly in the works.

This should serve as a wake-up call for users of non-Windows platforms, researchers note.

Kaspersky Lab discovered the so-called Operation AppleJeus while investigating a cryptocurrency exchange attacked by Lazarus Group. Its target had been hit with a Trojanized cryptocurrency application recommended to the company via email. One employee opened the message and downloaded the third-party app, infecting their machine with an old Lazarus Group tool dubbed Fallchill.

Multiple reports, including one from US-CERT, in the past year have pointed to the reappearance of Fallchill. The malware, a fully functional remote access Trojan, has been leveraged in attacks on the aerospace, finance, and telecommunications industries since 2016. Kaspersky researchers used the appearance of Fallchill in this scenario as a base for attribution to Lazarus Group.

In Operation AppleJeus, the malicious code was pushed in an update to Celas Trade Pro, a cryptocurrency trading app from Celas Limited. The vendor has a valid digital certificate for signing software and legitimate-looking registration records for its domain. However, researchers couldn't find a legitimate business located at the address noted on the certificate.

"When you start looking at bits and pieces behind the application, even that starts looking more and more illegitimate," says Kurt Baumgartner, principal security researcher at Kaspersky Lab.

When someone downloads the app only macOS, a hidden "autoupdater" module is installed in the background to begin immediately after the app is installed and after each system reboot. In most applications, updater components are used to download new program versions.

In the case of AppleJeus, the updater is used to collect information about the target machine and transmit the data back to the command-and-control server. If attackers decide it's worth infecting, they send a software update to install Fallchill. The Trojan provides attackers with "almost unlimited access" to the victim machine, giving them leeway to steal valuable financial data or deploy additional tools to snatch information.

Mac Attack

Lazarus Group developed software to target both the Windows and macOS platforms, and the malware works exactly the same on both operating systems. The extension to macOS is a recent and very narrow trend, Baumgartner notes.

"For the most part we see APT, we see mass exploitations, we see a lot of malware targeting Windows users," he explains. "This is the first time we've seen Lazarus in particular targeting macOS and users."

Why the move to Mac? Baumgartner isn't sure, but he speculates there is a possibility that cryptocurrency traders, and people on the cryptocurrency exchanges, are more interested – "and disproportionately interested" – in using macOS.

"There's no answer as to why, but that is new for them and it is unusual," he points out. Other threat groups, particularly Russian- and Chinese-speaking groups, have previously targeted macOS. It's a new move for Lazarus Group, but this isn't a one-time attack. "They're broadening the platforms they support," he adds. "They're going to continue going after macOS."

Because the Fallchill backdoor and C2 infrastructure have only been associated with the Trojanized cryptocurrency trading app, researchers believe the sole motive is financial gain.

Spotting Slip-ups: Where Lazarus Makes Mistakes

Baumgartner points out how Lazarus Group has a habit of dropping breadcrumbs, which simplify the process of attributing campaigns to the organization. One of the most interesting findings here comes from an additional backdoor hidden in hardcoded headers to communicate with the C2 server.

The Accept-Language HTTP header string revealed a language code associated with North Korea, which researchers say is unusual for malware. It seems the attackers forgot to change something in their developer environment, says Baumgartner.

"They make little mistakes every now and then that give us those insights into what is really behind this activity," he continues. In a previous incident, a malware operator was using multiple IPs connecting between France and Korea, but one short connection was made from an unusual IP range originating in North Korea.

"They do drop breadcrumbs, and these are pretty good breadcrumbs."

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
8/24/2018 | 10:09:51 AM
Re: Not the first malware
@mahmoodn It's Lazarus Group's first macOS malware variant, as noted in the article. And yes, there are definitely other macOS malware variants out there, but not from Lazarus. 
mahmoodn
0%
100%
mahmoodn,
User Rank: Apprentice
8/24/2018 | 3:06:22 AM
Not the first malware
Hi, What do you mean exactly by "the first macos malware"? There were Leap and RSPlug in the past decade.
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.
CVE-2018-16819
PUBLISHED: 2018-09-18
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests.
CVE-2018-16820
PUBLISHED: 2018-09-18
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests.