New Stealthy “RustDoor” Backdoor Focusing on Apple macOS Units

Feb 10, 2024NewsroommacOS Malware / Cyber Risk

Apple macOS customers are the goal of a brand new Rust-based backdoor that has been working underneath the radar since November 2023.

The backdoor, codenamed RustDoor by Bitdefender, has been discovered to impersonate an replace for Microsoft Visible Studio and goal each Intel and Arm architectures.

The precise preliminary entry pathway used to propagate the implant is presently not recognized, though it is mentioned to be distributed as FAT binaries that include Mach-O information.

A number of variants of the malware with minor modifications have been detected thus far, seemingly indicating energetic growth. The earliest pattern of RustDoor dates again to November 2, 2023.

It comes with a variety of instructions that enable it to assemble and add information, and harvest details about the compromised endpoint.

Some variations additionally embrace configurations with particulars about what information to gather, the listing of focused extensions and directories, and the directories to exclude.

The captured info is then exfiltrated to a command-and-control (C2) server.

The Romanian cybersecurity agency mentioned the malware is probably going linked to distinguished ransomware households like Black Basta and BlackCat owing to overlaps in C2 infrastructure.

“ALPHV/BlackCat is a ransomware household (additionally written in Rust), that first made its look in November 2021, and that has pioneered the general public leaks enterprise mannequin,” safety researcher Andrei Lapusneau mentioned.

In December 2023, the U.S. authorities introduced that it took down the BlackCat ransomware operation and launched a decryption instrument that greater than 500 affected victims can use to regain entry to information locked by the malware.