Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
1/24/2017
11:00 AM
Malwarebytes Labs
Malwarebytes Labs
Partner Perspectives
50%
50%

Meet 'Fruitfly:' Mac Malware Targeting Biomedical Research Centers

This newly discovered code contains indications that it has been circulating undetected for at least a couple years.

Not far into 2017, and the first Mac malware of the year has made its debut. The malware was brought to our attention by an IT admin who spotted strange outgoing network traffic from a particular Mac. This led to the discovery of a piece of malware unlike anything we’ve seen before, which appears to have actually been in existence undetected for some time, and which seems to be targeting biomedical research centers.

The malware, which we dubbed OSX.Backdoor.Quimitchin, was extremely simplistic on the surface, consisting of only two files: a hidden file and a launch agent. But one thing stood out when we found some truly antique system calls dating back to pre-OS X days. There are several other indications that this malware has been circulating undetected for at least a couple years. For example, a comment in the code indicates that a change was made for Yosemite (Mac OS X 10.10), which was released in October of 2014.

This newly discovered piece of malware can take screen captures and access the webcam via shell commands. Interestingly, it has code to do this both using the Mac and Linux commands, suggesting there might be a Linux variant. It can also receive instructions to perform tasks that include yet another method of capturing the screen, obtaining the screen size and mouse cursor position, changing the mouse position, simulating mouse clicks, and simulating key presses. This component appears to be intended to provide a kind of rudimentary remote control functionality.

We also observed the malware downloading an additional script from its Command and Control server. This script uses the multicast Domain Name System (mDNS) to build a map of all the other devices on the local network, giving information about each device including its IPv6 and IPv4 addresses, name on the network, and the port that is in use. It also appears to be making connection attempts to devices it finds on the network.

The only reason we think this malware hasn’t been spotted before now is that it is being used in tightly targeted attacks, limiting its exposure. There have been a number of stories over the past few years about Chinese and Russian hackers targeting and stealing US and European scientific research. Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.

Given the age of some of the code, this malware may go back decades. However, we shouldn’t take the age of the code as too strong an indication of the age of the malware. This could also signify that the hackers behind it really don’t know the Mac very well and were relying on old documentation. It could also be that they’re using old system calls to avoid triggering any kind of behavioral detections that might be expecting more recent code.

Despite the age and sophistication of this malware, it uses the same old unsophisticated technique for persistence that so many other pieces of Mac malware do: a hidden file and a launch agent. This makes it easy to spot, given any reason to look at the infected machine closely (such as unusual network traffic). It also makes it easy to detect and remove.

Apple calls this malware Fruitfly and has released an update that will be automatically downloaded behind the scenes to protect against future infections.

Check out Malwarebytes Labs for a more detailed breakdown of Fruitfly here

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7989
PUBLISHED: 2020-01-26
Adive Framework 2.0.8 has admin/user/add userUsername XSS.
CVE-2020-7990
PUBLISHED: 2020-01-26
Adive Framework 2.0.8 has admin/user/add userName XSS.
CVE-2020-7991
PUBLISHED: 2020-01-26
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
CVE-2020-7984
PUBLISHED: 2020-01-26
SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/a...
CVE-2019-16029
PUBLISHED: 2020-01-26
A vulnerability in the application programming interface (API) of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to change user account information which can prevent users from logging in, resulting in a denial of service (DoS) condition of the web interface. Th...