North Korea-linked APT targets job seekers with macOS malware
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | concrecapital.com | safarifontagent connects to a different C&C server (https://concrecapital[.]com/%user%.jpg). The C2 server did not respond at the time ES |
| sha256 | 49046dfeaefc59747e45e013f3ab5a2895b4245cfaa218dd2863d86451104506 | 3E86E100CE048830F86233910A2826FACD4272 (FinderFontsUpdater) 49046DFEAEFC59747E45E013F3AB5A2895B4245CFAA218DD2863D86451104506 (safarifontagent) … 6/7 — ESET Research (@ESETresearch) Aug |
| sha256 | 798020270861fdd6c293ae8ba13e86e100ce048830f86233910a2826facd4272 | 7AFB2F8A478B0E0A37D9A1A6C4C1E7CD01E404CC5DD2853 (Extractor) 798020270861FDD6C293AE8BA13E86E100CE048830F86233910A2826FACD4272 (FinderFontsUpdater) 49046DFEAEFC59747E45E013F3AB5A2895B424 |
| sha256 | fe336a032b564eef07afb2f8a478b0e0a37d9a1a6c4c1e7cd01e404cc5dd2853 | ared Indicators of compromise (IoCs) for this threat. IoCs: FE336A032B564EEF07AFB2F8A478B0E0A37D9A1A6C4C1E7CD01E404CC5DD2853 (Extractor) 798020270861FDD6C293AE8BA13E86E100CE048830F8623 |
Full article277 words · extracted from securityaffairs.com · click to collapse
The North Korea-linked Lazarus Group has been observed targeting job seekers with macOS malware working also on Intel and M1 chipsets.
ESET researchers continue to monitor a cyberespionage campaign, tracked as “Operation In(ter)ception,” that has been active at least since June 2020. The campaign targets employees working in the aerospace and military sectors and leverages decoy job offer documents.
ESET published a series of tweets detailing the recent attacks, the experts spotted a signed Mac executable disguised as a job description for Coinbase. The malicious code was uploaded to VirusTotal from Brazil on August 11, 2022.
Malware is compiled for both Intel and Apple Silicon, it drops three files: a decoy PDF document Coinbase_online_careers_2022_07.pdf, a bundle http://FinderFontsUpdater.app and a downloader safarifontagent. The discovery is similar to other attacks detected by ESET researches in May.
The bundle employed in the attack is signed July 21 using a certificate issued in February 2022 to a developer named Shankey Nohria and team identifier 264HFWQH63.
“The application is not notarized and Apple has revoked the certificate on August 12.” states ESET.
Experts noticed that unlike May attacks, the downloader safarifontagent connects to a different C&C server (https://concrecapital[.]com/%user%.jpg). The C2 server did not respond at the time ESET experts analyzed this malware.
The researcher @h2jazi also discovered a Windows counterpart of this malware on August 4, it was dropping the exact same decoy.
ESET also shared Indicators of compromise (IoCs) for this threat.
IoCs:
— ESET Research (@ESETresearch) August 16, 2022
FE336A032B564EEF07AFB2F8A478B0E0A37D9A1A6C4C1E7CD01E404CC5DD2853 (Extractor)
798020270861FDD6C293AE8BA13E86E100CE048830F86233910A2826FACD4272 (FinderFontsUpdater)
49046DFEAEFC59747E45E013F3AB5A2895B4245CFAA218DD2863D86451104506 (safarifontagent)
… 6/7
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, North Korea)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/134491/malware/north-korea-mac-malware-m1.html