Full Report
Analyzing a new threat targeting macOS users in Europe, North America and MEA
Analysis Summary
# Tool/Technique: RustyUnit (macOS Stealer/Backdoor Campaign)
## Overview
RustyUnit refers to a sophisticated multi-stage campaign targeting macOS users across Europe, North America, and the MEA region. The threat utilizes a combination of custom-built AppleScript/Shell orchestrators, specialized credential stealers, and a persistent backdoor to exfiltrate sensitive data including browser passwords, keychain data, and cryptocurrency wallets.
## Technical Details
- **Type:** Malware family (Stealer/Backdoor)
- **Platform:** macOS
- **Capabilities:** Credential harvesting, Keychain dumping, Crypto-wallet theft, Persistent remote access.
- **First Seen:** Reported Q1 2024 (based on Group-IB analysis).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- **TA0003 - Persistence**
- T1543.001 - Create or Modify System Process: Launch Agent
- **TA0006 - Credential Access**
- T1555.001 - Credentials from Password Stores: Keychain
- T1552.001 - Unsecured Credentials: Forgein File System (Browser cookies/logins)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
- T1105 - Ingress Tool Transfer
- **TA0010 - Exfiltration**
- T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage
## Functionality
### Core Capabilities
- **Orchestration:** Uses `script.sh` to coordinate the download and execution of various modules from compromised WordPress sites.
- **Keychain Theft:** The `chromer` module is specifically designed to extract and decrypt data from the macOS Keychain.
- **Credential Harvesting:** The `zsh.txt` (renamed to `zoom`) module targets browser-based credentials and session data.
- **Crypto Stealing:** The `finder.sh` module scans the system for cryptocurrency wallet files and private keys.
### Advanced Features
- **GSocket Backdoor:** Utilizes the "GSocket" (Global Socket) framework to establish a persistent, encrypted C2 tunnel that can bypass firewalls and NAT without requiring open ports.
- **Masquerading:** Malware components masquerade as legitimate macOS processes or applications like "Zoom" and "Finder" to evade visual detection by the user.
## Indicators of Compromise
- **File Hashes (SHA1):**
- `d9617710d4ed8e9b87f6fee0b7014c4101effba0` (script.sh)
- `b67aa4f598c0ea625a7409ea7884e10a7bc9c3ff` (chromer)
- `8dda05168ea8610a2449419a47517bc32823d6ec` (zoom/zsh.txt)
- `0a1fb016bd10bac5455175c79aa4511e5ff1a330` (finder.sh)
- `2fc970e25570532f9cbe33b7ebfe1f0383a7341a` (goyim/GSocket)
- **File Names:** `chromer.txt`, `zsh.txt`, `finderv2.jpg`, `goyim`, `script.sh`
- **Network Indicators:**
- hxxps://panalobet[.]ph/wp-content/
- hxxps://store.grafsynergy[.]com/media/
- hxxps://cottonbox[.]co[.]il/wp-content/
- **Behavioral Indicators:** Unexpected AppleScript execution prompts, unauthorized modifications to `~/Library/LaunchAgents`, and unusual network traffic to GSocket relay nodes.
## Associated Threat Actors
- Unknown (Currently undergoing further attribution; targeting patterns suggest financially motivated or high-value data theft).
## Detection Methods
- **Signature-based:** Deploy the SHA1 hashes listed above to EDR and AV solutions.
- **Behavioral detection:** Monitor for unsigned binaries attempting to access `~/Library/Keychains/` or `~/Library/Application Support/Google/Chrome/`.
- **YARA Rules:** Target the unique strings found in the GSocket implementation and the Shell-based orchestrator script.
## Mitigation Strategies
- **Prevention:** Implement strict Gatekeeper policies and prevent the execution of unsigned scripts from the `/tmp/` or `~/Library/` directories.
- **Hardening:** Use Mobile Device Management (MDM) to restrict "Allow Accessories to Connect" and "Screen Recording" permissions for unverified apps.
- **User Awareness:** Educate users on the risks of downloading software from unofficial sources or clicking links in unsolicited emails.
## Related Tools/Techniques
- **GSocket:** A legitimate peer-to-peer networking tool abused by attackers for C2.
- **Realst Stealer:** Another macOS-specific stealer known for targeting crypto-wallets via similar delivery methods.