Vulnerabilities / Threats

8/23/2018
03:07 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Lazarus Group Builds its First MacOS Malware

This isn't the first time Lazarus Group has infiltrated a cryptocurrency exchange as the hacking team has found new ways to achieve financial gain.

Same goals, new tools: Lazarus Group is targeting cryptocurrency exchanges with macOS malware, a sign the nation-state group is developing attacks for a broader variety of platforms to achieve its goal of financial gain.

This is the first case in which Kaspersky Lab researchers spotted Lazarus Group using malware targeting macOS. It seems the group - believed to be out of North Korea - wants to ensure OS platforms don't interfere with infecting targets, so it's building malware for different operating systems. A version of the same malware tailored for Linux is reportedly in the works.

This should serve as a wake-up call for users of non-Windows platforms, researchers note.

Kaspersky Lab discovered the so-called Operation AppleJeus while investigating a cryptocurrency exchange attacked by Lazarus Group. Its target had been hit with a Trojanized cryptocurrency application recommended to the company via email. One employee opened the message and downloaded the third-party app, infecting their machine with an old Lazarus Group tool dubbed Fallchill.

Multiple reports, including one from US-CERT, in the past year have pointed to the reappearance of Fallchill. The malware, a fully functional remote access Trojan, has been leveraged in attacks on the aerospace, finance, and telecommunications industries since 2016. Kaspersky researchers used the appearance of Fallchill in this scenario as a base for attribution to Lazarus Group.

In Operation AppleJeus, the malicious code was pushed in an update to Celas Trade Pro, a cryptocurrency trading app from Celas Limited. The vendor has a valid digital certificate for signing software and legitimate-looking registration records for its domain. However, researchers couldn't find a legitimate business located at the address noted on the certificate.

"When you start looking at bits and pieces behind the application, even that starts looking more and more illegitimate," says Kurt Baumgartner, principal security researcher at Kaspersky Lab.

When someone downloads the app only macOS, a hidden "autoupdater" module is installed in the background to begin immediately after the app is installed and after each system reboot. In most applications, updater components are used to download new program versions.

In the case of AppleJeus, the updater is used to collect information about the target machine and transmit the data back to the command-and-control server. If attackers decide it's worth infecting, they send a software update to install Fallchill. The Trojan provides attackers with "almost unlimited access" to the victim machine, giving them leeway to steal valuable financial data or deploy additional tools to snatch information.

Mac Attack

Lazarus Group developed software to target both the Windows and macOS platforms, and the malware works exactly the same on both operating systems. The extension to macOS is a recent and very narrow trend, Baumgartner notes.

"For the most part we see APT, we see mass exploitations, we see a lot of malware targeting Windows users," he explains. "This is the first time we've seen Lazarus in particular targeting macOS and users."

Why the move to Mac? Baumgartner isn't sure, but he speculates there is a possibility that cryptocurrency traders, and people on the cryptocurrency exchanges, are more interested – "and disproportionately interested" – in using macOS.

"There's no answer as to why, but that is new for them and it is unusual," he points out. Other threat groups, particularly Russian- and Chinese-speaking groups, have previously targeted macOS. It's a new move for Lazarus Group, but this isn't a one-time attack. "They're broadening the platforms they support," he adds. "They're going to continue going after macOS."

Because the Fallchill backdoor and C2 infrastructure have only been associated with the Trojanized cryptocurrency trading app, researchers believe the sole motive is financial gain.

Spotting Slip-ups: Where Lazarus Makes Mistakes

Baumgartner points out how Lazarus Group has a habit of dropping breadcrumbs, which simplify the process of attributing campaigns to the organization. One of the most interesting findings here comes from an additional backdoor hidden in hardcoded headers to communicate with the C2 server.

The Accept-Language HTTP header string revealed a language code associated with North Korea, which researchers say is unusual for malware. It seems the attackers forgot to change something in their developer environment, says Baumgartner.

"They make little mistakes every now and then that give us those insights into what is really behind this activity," he continues. In a previous incident, a malware operator was using multiple IPs connecting between France and Korea, but one short connection was made from an unusual IP range originating in North Korea.

"They do drop breadcrumbs, and these are pretty good breadcrumbs."

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
8/24/2018 | 10:09:51 AM
Re: Not the first malware
@mahmoodn It's Lazarus Group's first macOS malware variant, as noted in the article. And yes, there are definitely other macOS malware variants out there, but not from Lazarus. 
mahmoodn
0%
100%
mahmoodn,
User Rank: Apprentice
8/24/2018 | 3:06:22 AM
Not the first malware
Hi, What do you mean exactly by "the first macos malware"? There were Leap and RSPlug in the past decade.
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.