Related Families: PondRAT, PoolRAT
Verticals Targeted: Software Development
Labyrinth Chollima Using Poisoned Python Packages to Deliver PondRAT
Sep 30, 2024 1:49:09 PM / by The Hivemind posted in Threat Bulletin, North Korea, Linux, MacOS, PondRAT, PoolRAT, Labyrinth Chollima
HZ Rat MacOS Variant
Sep 13, 2024 2:19:08 PM / by The Hivemind posted in Threat Bulletin, Backdoor, RAT, MacOS, HZ Rat
Executive Summary
A MacOS variant of HZ Rat was recently discovered targeting messaging apps in China. HZ Rat is a basic backdoor, and shell commands received from the C2 provide additional functionality.
Cthulhu MacOS Stealer
Aug 30, 2024 2:09:06 PM / by The Hivemind posted in Threat Bulletin, Stealer, MacOS, Cthulhu
Related Families: Atomic Stealer
Executive Summary
Cthulhu is a stealer malware targeting MacOS systems. First observed in 2023, this malware-as-a-service (MaaS) is capable of targeting both x86_64 and ARM architectures.
Cosmic Leopard Activity Targets Windows, MacOS, & Android
Jun 17, 2024 3:15:17 PM / by The Hivemind posted in Threat Bulletin, Android, Windows, MacOS, Cosmic Leopard, GravityRAT, Operation Celestial Force, HeavyLift, GravityAdmin
Related Families: GravityRAT, HeavyLift, GravityAdmin
Verticals Targeted: Defense, Government, Technology
Executive Summary
Cosmic Leopard was observed targeting Windows, MacOS, and Android devices in a series of ongoing campaigns dubbed Operation Celestial Force. The threat actors used GravityRAT and HeavyLift to target entities in India.
Cuckoo: Part Infostealer, Part Spyware
May 13, 2024 2:20:01 PM / by The Hivemind posted in Threat Bulletin, Infostealer, Spyware, MacOS, Cuckoo
Executive Summary
Cuckoo is a recently discovered infostealer and spyware hybrid targeting MacOS systems.
RustDoor MacOS Backdoor
Feb 26, 2024 11:51:18 AM / by The Hivemind posted in Threat Bulletin, Ransomware, ALPHV, Backdoor, MacOS, Mac, Apple, RustDoor, GateDoor
Related Families: GateDoor
Verticals Targeted: Cryptocurrency
Executive Summary
RustDoor is a new MacOS backdoor written in Rust. RustDoor was observed targeting companies in the cryptocurrency sector.
SpectralBlur MacOS Backdoor
Jan 19, 2024 2:03:16 PM / by The Hivemind posted in Threat Bulletin, Backdoor, MacOS, Stardust Chollima, SpectralBlur, KandyKorn
Related Families: KandyKorn
Executive Summary
SpectralBlur is a fairly unsophisticated backdoor targeting MacOS devices. It has been attributed to Stardust Chollima.
New XLoader Variant Disguised as Signed App
Sep 1, 2023 1:24:48 PM / by The Hivemind posted in Threat Bulletin, Xloader, MacOS
Executive Summary
A new XLoader variant has been observed in the wild, targeting MacOS systems and disguising itself as a signed OfficeNote app.