Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
1/24/2017
11:00 AM
Malwarebytes Labs
Malwarebytes Labs
Partner Perspectives
50%
50%

Meet 'Fruitfly:' Mac Malware Targeting Biomedical Research Centers

This newly discovered code contains indications that it has been circulating undetected for at least a couple years.

Not far into 2017, and the first Mac malware of the year has made its debut. The malware was brought to our attention by an IT admin who spotted strange outgoing network traffic from a particular Mac. This led to the discovery of a piece of malware unlike anything we’ve seen before, which appears to have actually been in existence undetected for some time, and which seems to be targeting biomedical research centers.

The malware, which we dubbed OSX.Backdoor.Quimitchin, was extremely simplistic on the surface, consisting of only two files: a hidden file and a launch agent. But one thing stood out when we found some truly antique system calls dating back to pre-OS X days. There are several other indications that this malware has been circulating undetected for at least a couple years. For example, a comment in the code indicates that a change was made for Yosemite (Mac OS X 10.10), which was released in October of 2014.

This newly discovered piece of malware can take screen captures and access the webcam via shell commands. Interestingly, it has code to do this both using the Mac and Linux commands, suggesting there might be a Linux variant. It can also receive instructions to perform tasks that include yet another method of capturing the screen, obtaining the screen size and mouse cursor position, changing the mouse position, simulating mouse clicks, and simulating key presses. This component appears to be intended to provide a kind of rudimentary remote control functionality.

We also observed the malware downloading an additional script from its Command and Control server. This script uses the multicast Domain Name System (mDNS) to build a map of all the other devices on the local network, giving information about each device including its IPv6 and IPv4 addresses, name on the network, and the port that is in use. It also appears to be making connection attempts to devices it finds on the network.

The only reason we think this malware hasn’t been spotted before now is that it is being used in tightly targeted attacks, limiting its exposure. There have been a number of stories over the past few years about Chinese and Russian hackers targeting and stealing US and European scientific research. Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.

Given the age of some of the code, this malware may go back decades. However, we shouldn’t take the age of the code as too strong an indication of the age of the malware. This could also signify that the hackers behind it really don’t know the Mac very well and were relying on old documentation. It could also be that they’re using old system calls to avoid triggering any kind of behavioral detections that might be expecting more recent code.

Despite the age and sophistication of this malware, it uses the same old unsophisticated technique for persistence that so many other pieces of Mac malware do: a hidden file and a launch agent. This makes it easy to spot, given any reason to look at the infected machine closely (such as unusual network traffic). It also makes it easy to detect and remove.

Apple calls this malware Fruitfly and has released an update that will be automatically downloaded behind the scenes to protect against future infections.

Check out Malwarebytes Labs for a more detailed breakdown of Fruitfly here

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26246
PUBLISHED: 2020-12-03
Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.
CVE-2020-29279
PUBLISHED: 2020-12-02
PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
CVE-2020-29280
PUBLISHED: 2020-12-02
The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.
CVE-2020-29282
PUBLISHED: 2020-12-02
SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.
CVE-2020-29283
PUBLISHED: 2020-12-02
An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parameter to getuser.php.