Experts discovered GIMMICK custom malware for macOS

Volexity cybersecurity researchers felfedezték a new variant of macOS malware called GIMMICK that is believed to be used by the Chinese cybercriminal group Storm Cloud.

Experts have identified malware in the RAM of a MacBook Pro running macOS 11.6 (Big Sur) that was compromised during a cyber-espionage campaign in late 2021.

GIMMICK is a multi-platform malware written in Objective C (for macOS) or .NET and Delphi (for Windows). All variants of the malware use the same C&C architecture, file paths, behaviours, és Google Drive features. Therefore, they are tracked as one tool, despite the differences in the code.

GIMMICK is run either directly by the user or as a daemon on the system, and is installed as a binary file called PLIST, usually simulating an actively used application on the target device.

The malware then initializes itself by taking several steps to decode the data and eventually establishes a session with Google Drive using the built-in OAuth2 credentials.

Once initialized, GIMMICK loads three malicious components: DriveManager, FileManager, és GCDTimerManager. The first component is responsible for managing Google Drive sessions, keeping the local map of the Google Drive directory hierarchy in memory, managing locks for synchronizing tasks in a Google Drive session, and handling uploading and downloading tasks into a Google Drive session.

The hardware UUID of each infected system is used as the identifier of its corresponding Google Drive directory.

The FileManager manages the local directory that stores C&C information and tasks, while the GCDTimerManager takes care of managing the various GCD objects.

Due to the asynchronous nature of malware, command execution requires a phased approach. Although individual steps are executed asynchronously, all commands are executed in the same way.the experts noted.
Apple has also rolled out new protections for all supported versions of macOS with new signatures for XProtect and MRT, which should block and remove malware from March 17, 2022.

Let me remind you that A kínai hackerek elfedik a nyomaikat, és néhány nappal az észlelés előtt eltávolítják a rosszindulatú programokat, és azt is Cynos malware from AppGallery infiltrated at least 9.3 millió Android készülék.

Helga Smith

Mindig is érdekelt az informatika, különösen az adatbiztonság és a téma, amelyet manapság úgy hívnak "adattudomány", tizenéves kora óta. Mielőtt a Víruseltávolító csapathoz került volna főszerkesztőként, Több cégnél dolgoztam kiberbiztonsági szakértőként, köztük az Amazon egyik vállalkozója. Újabb élmény: Arden és Reading egyetemeken tanítok.

Válaszolj

Ez az oldal az Akismetet használja a spamek csökkentésére. Ismerje meg, hogyan dolgozzák fel megjegyzései adatait.

'Fel a tetejéhez' gomb