Experts discovered GIMMICK custom malware for macOS

Volexity cybersecurity researchers A descoperit a new variant of macOS malware called GIMMICK that is believed to be used by the Chinese cybercriminal group Storm Cloud.

Experts have identified malware in the RAM of a MacBook Pro running macOS 11.6 (Big Sur) that was compromised during a cyber-espionage campaign in late 2021.

GIMMICK is a multi-platform malware written in Objective C (for macOS) or .NET and Delphi (for Windows). All variants of the malware use the same C&C architecture, file paths, behaviours, și Google Drive features. Prin urmare, they are tracked as one tool, despite the differences in the code.

GIMMICK is run either directly by the user or as a daemon on the system, and is installed as a binary file called PLIST, usually simulating an actively used application on the target device.

The malware then initializes itself by taking several steps to decode the data and eventually establishes a session with Google Drive using the built-in OAuth2 credentials.

Once initialized, GIMMICK loads three malicious components: DriveManager, FileManager, și GCDTimerManager. The first component is responsible for managing Google Drive sessions, keeping the local map of the Google Drive directory hierarchy in memory, managing locks for synchronizing tasks in a Google Drive session, and handling uploading and downloading tasks into a Google Drive session.

The hardware UUID of each infected system is used as the identifier of its corresponding Google Drive directory.

The FileManager manages the local directory that stores C&C information and tasks, while the GCDTimerManager takes care of managing the various GCD objects.

Due to the asynchronous nature of malware, command execution requires a phased approach. Although individual steps are executed asynchronously, all commands are executed in the same way.the experts noted.
Apple has also rolled out new protections for all supported versions of macOS with new signatures for XProtect and MRT, which should block and remove malware from March 17, 2022.

Let me remind you that Hackerii chinezi își acoperă urmele și elimină programele malware cu câteva zile înainte de detectare, și de asemenea că Cynos malware from AppGallery infiltrated at least 9.3 milioane de dispozitive Android.

Helga Smith

Am fost mereu interesat de informatică, în special securitatea datelor și tema, care se numește în zilele noastre "știința datelor", încă din prima adolescență. Înainte de a intra în echipa de eliminare a virușilor în calitate de redactor-șef, Am lucrat ca expert în securitate cibernetică în mai multe companii, inclusiv unul dintre contractorii Amazon. O altă experiență: Am predat în universitățile Arden și Reading.

lasa un raspuns

Acest site folosește Akismet pentru a reduce spamul. Aflați cum sunt procesate datele comentariilor dvs.

Butonul înapoi la început