OceanLotus macOS Backdoor
The OceanLotus advanced persistent threat group has developed a new backdoor that can take control of macOS devices.
Summary
The OceanLotus advanced persistent threat group has developed a new backdoor that can take control of macOS devices.
Threat details
Introduction
The OceanLotus advanced persistent threat group, also known as APT32, has developed a new backdoor that can take control of macOS devices.
Delivery
OceanLotus has been observed delivering malware using malicious websites. This backdoor is packaged as an app bundled in a Zip archive, but it uses the Microsoft Word icon and '.doc' extension to disguise itself as a legitimate document.
Activities
When the app bundle is opened it executes a shell script automatically. This extracts the second-stage payload and changes access permissions to launch it.
The second stage drops the third-stage payload to ~/Library/User Photos/mount_devfs and ensures it will run automatically at login by installing a LaunchAgent in ~/Library/LaunchAgents/com.apple.marcoagent.voiceinstallerd.plist
The third stage collects system information and communicates with command and control (C2) servers. The capabilities include downloading and executing additional files, stealing data and running terminal commands.
Remediation advice
To prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that the NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 3 December 2020 3:25 pm