RustyAttr: North Korean hackers found a "blind spot" in macOS protection

[Man]

Hackers have learned to hide viruses where no one is looking for them.

Group-IB specialists have identified a new way to distribute a Trojan for macOS called RustyAttr. Hackers use advanced file attributes to hide malicious code in metadata and use fake PDF documents to bypass defenses.

The essence of the technique is that attackers hide malicious code in extended attributes of macOS files. This metadata is usually hidden from the user's eyes and is not visible in the Finder or terminal. They can only be seen and changed with the special "xattr" command. In the case of RustyAtr, the hidden attribute is called "test" and contains a shell script.

Malicious applications using this technique are based on the Tauri framework, which combines a web frontend (HTML, JavaScript) with a Rust backend. When launched, these applications load a web page where a JavaScript script «preload.js" retrieves code from a hidden attribute and runs it.

To avoid arousing suspicion, hackers use fake PDFs or show error messages. These PDF documents are downloaded from the pCloud service and often have names related to cryptocurrency investments, which coincides with the goals of the Lazarus group. Group-IB experts believe that hackers from Lazarus may be behind this attack, but there is no exact confirmation of this yet. Researchers believe that the attackers are now testing a new way to distribute malware.

Infection chain

The method used turned out to be effective in bypassing antivirus solutions — none of the analyzers of the Virus Total platform recognized malicious files. The programs were signed with a compromised certificate, which Apple has already revoked, but they did not go through the notarization procedure.

At the moment, researchers have not been able to extract and study the next link in the malicious chain, but they have found a connection to a familiar domain that is used in the Lazarus infrastructure to download malware.

Previously, a similar tactic was used by another North Korean group, BlueNoroff. The group used cryptocurrency-themed phishing to trick users into installing malicious applications. These programs were also signed, but used a different technique to bypass protection. While it is not known whether these attacks are related, experts suggest that hackers may be sharing successful hacking techniques to bypass macOS security systems.

For now, built-in macOS tools such as Gatekeeper block these applications from running unless users have disabled protection. However, if users disable Gatekeeper, it will allow attackers to bypass security. Lazarus can refine its techniques and prepare new versions of attacks with signed and notarized applications to bypass macOS protection.

Source

 

[Man]

New malwar RustyAttr for macOS

Researchers from Group-IB reveal a new technique called the Lazarus APT to propagate a new Trojan, which the researchers called RustyAttr.

Hackers use advanced metadata attributes of macOS files to hide malicious code, and also use fake PDF documents to avoid detection on Apple's systems.

The new technique is similar to how the Bundlore adware in 2020 hid its payloads in resource forks to hide macOS payloads. It was found in several malware samples in the wild by researchers from Group-IB.

Based on the results of the analysis and in view of the absence of victims, the researchers attribute the samples with moderate confidence to the North Korean Lazarus, which is supposed to be experimenting with a new solution for delivering malware.

The method is unusual and has been shown to be effective against detection, as none of the solutions based on the Virus Total platform have flagged files as malicious.

macOS Extended Attributes (EAs) are hidden metadata, usually associated with files and directories, that are not directly visible in the Finder or Terminal, but can be extracted using the "xattr" command for editing.

In the case of RustyAttr attacks, the EA name is "test" and it contains a shell script.

The malicious apps that store EA are built using the Tauri framework, which combines the frontend (HTML, JavaScript) by calling functions on the Rust backend.

When the app starts, it loads a web page that contains JavaScript (preload.js) that retrieves content from the location specified in the "test" EA and sends it to the run_command function to execute the shell script.

To avoid arousing suspicion from users during the process, some samples run fake PDFs or display dialogs with error messages.

The PDF file is extracted from a pCloud instance for public file sharing, which also contains entries with names associated with cryptocurrency investment topics, which is in line with Lazarus' goals and objectives.

Group-IB found that several samples of RustyAttr apps had already passed tests for Virus Total, and the apps were signed using a leaked certificate that Apple has since revoked but was not certified.

The researchers were unable to extract and analyze the next-stage malware, but found that an intermediate server connects to a known endpoint in the Lazarus infrastructure to attempt to retrieve it.

IOCs and YARA - in the report: https://www.group-ib.com/blog/stealthy-attributes-of-apt-lazarus/