Full Report
In this blog, we examine a fresh take on Lazarus's techniques regarding concealing codes in Extended Attributes.
Analysis Summary
# Threat Actor: Lazarus Group
## Attribution & Identity
- **Actor Identification:** Lazarus Group (attributed to the Democratic People’s Republic of Korea - DPRK).
- **Aliases:** Hidden Cobra, APT38, Zinc, Labyrinth Chollima.
- **Known Associations:** The actor is widely recognized as a state-sponsored entity operating under North Korean intelligence agencies.
## Activity Summary
The reported campaign involves a sophisticated macOS-based attack utilizing a novel technique to conceal malicious code within **Extended Attributes (EA)** of files. Lazarus leveraged fake job descriptions and investment-related lures to deliver trojanized applications. A key highlight of this activity is the use of the **Tauri framework** (a toolkit for building cross-platform desktop apps with Rust and Webview) to create legitimate-looking interfaces while executing malicious logic in the background.
## Tactics, Techniques & Procedures
- **Extended Attribute Manipulation:** Storing malicious payloads or scripts within macOS Extended Attributes to evade detection by security tools that primarily scan file contents.
- **Social Engineering:** Distributing malicious `.app.zip` files disguised as "Investment Decision-Making Questionnaires" or "Synergy Exploration" documents.
- **Multi-Stage Execution:** Use of AppleScript and Unix Shell scripts to extract and execute hidden payloads from the application's attributes.
- **Cross-Platform Development:** Use of the **Tauri** framework to compile malicious binaries, blending web technologies with Rust for backend execution.
- **MITRE ATT&CK IDs:**
- **T1059.002:** Command and Scripting Interpreter: AppleScript
- **T1059.004:** Command and Scripting Interpreter: Unix Shell
- **T1564:** Hide Artifacts
- **T1105:** Ingress Tool Transfer
## Targeting
- **Sectors:** Financial services, Cryptocurrency, Investment firms, and potentially HR/Recruitment.
- **Geography:** Global (based on previous Lazarus patterns), with lures written in English targeting international professionals.
- **Victims:** Individuals involved in investment evaluation and business development.
## Tools & Infrastructure
- **Malware:**
- **RustyAttr:** A novel malware family written in Rust (using Tauri) designed to fetch and execute code hidden in Extended Attributes.
- Trojanized versions of legitimate apps (e.g., "VooV Meeting").
- **Infrastructure (Defanged):**
- **Domains:**
- support[.]cloudstore[.]business
- support[.]docsend[.]site
- hxxps://filedn[.]com/lY24cv0IfefboNEIN0I9gqR
- **IP Addresses:**
- 104.168.165[.]203
- 104.168.157[.]45
## Implications
Lazarus continues to evolve its macOS toolkit, demonstrating a high degree of adaptability by adopting modern frameworks like Tauri. The shift toward using Extended Attributes for code storage indicates a strategic move to bypass signature-based detection and traditional file integrity monitoring. This highlights a persistent threat to macOS environments within the financial and crypto sectors.
## Mitigations
- **Monitor Extended Attributes:** Implement security monitoring for unusual modifications or large data blobs stored in macOS Extended Attributes (e.g., via `xattr` command logs).
- **Application Whitelisting:** Restrict the execution of unsigned or self-signed applications on macOS workstations.
- **User Awareness:** Train employees to exercise caution when downloading "questionnaires" or "job descriptions" in executable formats (.app or .zip containing apps) from external sources.
- **Endpoint Detection:** Deploy EDR solutions capable of detecting AppleScript and Shell execution originating from non-standard application resources.