2023年6月21日

一組惡意組件已經被Bitdefender發現被認為是一個先進的工具包的一部分,旨在妥協macOS係統。目前,缺乏信息。研究人員進行了分析通過研究四個樣本被匿名共享在VirusTotal受害者。樣品最早可以追溯到4月18日,2023年。深入細節三分之二的惡意程序發現麵向後門,統稱為JokerSpy。這些後門設計目標Windows、Linux和macOS係統。第一個組件,共享。dat,執行一個操作係統檢查和連接到一個遠程服務器檢索進一步指示。在樣本中,比特凡德發現了一個更強大的名為sh.py的後門,具有多平台功能。第三個組件是一個脂肪二進製名叫xcc,斯威夫特寫的,專門針對macOS蒙特雷(12)版本和更新。 Why this matters The first component carries out tasks such as gathering system information, executing commands, downloading and running files on the victim's machine, and self-termination. The backdoor, sh.py, is capable of gathering system metadata, file enumeration, file deletion, command and file execution, and batch exfiltration of encoded data. The third component primarily checks for permission before utilizing a potential spyware component (possibly for screen capturing), but it does not contain the spyware component itself. Based on the above and that multiple files were missing from the victim system, the researchers suspect that the malicious artifacts are part of a more intricate attack. The bottom line While a lot about this activity remains unknown, it should be considered to be a potent threat and necessary cyber defense measures should be implemented. Furthermore, with the rising number of malicious activities against macOS users, it is recommended to strengthen their security posture.