New MacOS X backdoor variant used in APT attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2009-0563 | Buffer Overflow RCE in Microsoft Office via Crafted Word Document CVE-2009-0563 is a buffer overflow (CWE-119) in Microsoft Office in which a Word document containing a crafted tag with an invalid length field overflows a buffer when the document is parsed. An attacker triggers the flaw by persuading a user to open a maliciously crafted Word file, typically delivered via email or a download. Successful exploitation yields remote code execution running in the context of the user who opened the document, allowing the attacker to install or run software, or view and change data. Any user of an affected Microsoft Office release is exposed; the CISA catalog lists the affected product simply as Microsoft Office. Exploitation is confirmed in the wild: CISA added the CVE to the KEV catalog on 2022-06-08, EPSS assigns a 63.1% probability of exploitation within 30 days, and the related headlines describe APT backdoor campaigns against Mac users consistent with targeted use of this flaw. Do: Apply Microsoft security updates per vendor instructions, and upgrade or fully patch legacy Office installations that no longer receive updates, verifying that no endpoints (including Mac systems, given reported APT activity) remain on unpatched versions. Treat unsolicited Word documents as untrusted and monitor for suspicious processes spawned by Office when documents are opened. Because this flaw is KEV-listed with known in-the-wild exploitation, prioritize patching and hunt for document-opening activity consistent with targeted attacks. | — | 63% | KEV |
| mass≈100M+ users (Office's global install base; remaining unpatched legacy installs plausibly in the millions) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| md5 | e88027e4bfc69b9d29caef6bae0238e8 | MaControl.b”. MD5 ( “matiriyal.app/Contents/MacOS/iCnat” ): e88027e4bfc69b9d29caef6bae0238e8 When executed, it installs itself in the system and connect |
Full article443 words · extracted from securelist.com · click to collapse
Two days ago we intercepted a new APT campaign using a new MacOS X backdoor variant targeted at Uyghur activists.
But before we go into details, let’s start with a quiz:
– The Dalai Lama walks into an Apple Store. Why?
A possible answer is, “to buy one of the new MacBook Pro’s with the Retina display!” (speaking of which, I would very much like to buy one of those as well, but it’s kind of difficult to justify the hit to the family budget)
Joke aside, actually Dalai Lama is a well known Mac user. Here’s a photo of him using a Mac during a conf call:
And a better one of him using a 17” MacBook Pro:
Perhaps it is no surprise that we are seeing an increase in the number of APT attacks against such high profile users using Mac’s.
On June 27th, we’ve intercepted a new wave of APT attacks targeting certain Uyghur Mac users.
The e-mails have a ZIP file attached. Inside the ZIP file, there’s a JPG photo and a MacOS X app:
The application is actually a new, mostly undetected version of the MaControl backdoor (Universal Binary), which supports both i386 and PowerPC Macs. We detect it as “Backdoor.OSX.MaControl.b”.
MD5 ( “matiriyal.app/Contents/MacOS/iCnat” ): e88027e4bfc69b9d29caef6bae0238e8
When executed, it installs itself in the system and connects to its Command and Control server to get instructions. The backdoor allows its operator to list files, transfer files and generally, run commands on the infected machine.
As usual, although some of the comments and debug info are in English, they contain common mistakes:
– “Recieve” instead of “Receive”
– “os verison” instead of “os version”
– “memery” instead of “memory”
– Etc…
The backdoor is quite flexible – its Command and Control servers are stored in a configuration block which has been appended at the end of the file, 0x214 bytes in size. The configuration block is obfuscated with a simple “substract 8” operation.
Once decrypted, the command and control server address can be read: 61.178.77.*, located in China:
With Macs growing in popularity and their increased adoption by high profile targets, we expect the number of MacOS X APT attacks will also grow. Previous attacks used MS Office exploits (Exploit.MSWord.CVE-2009-0563.a.); the one described here relies on social engineering to get the user to run the backdoor. Just like with PC malware, a combination of exploits and social engineering tricks are generally the most effective; it won’t be surprising to see a spike in such attacks soon.
Update: AlienVault posted a description of the Windows counterpart of the backdoor used in this attack. You can read their analysis here.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/new-macos-x-backdoor-variant-used-in-apt-attacks/33214/