Experts discovered GIMMICK custom malware for macOS

Volexity cybersecurity researchers have discovered a new variant of macOS malware called GIMMICK that is believed to be used by the Chinese cybercriminal group Storm Cloud.

Experts have identified malware in the RAM of a MacBook Pro running macOS 11.6 (Big Sur) that was compromised during a cyber-espionage campaign in late 2021.

GIMMICK is a multi-platform malware written in Objective C (for macOS) or .NET and Delphi (for Windows). All variants of the malware use the same C&C architecture, file paths, behaviours, in Google Drive features. Therefore, they are tracked as one tool, despite the differences in the code.

GIMMICK is run either directly by the user or as a daemon on the system, and is installed as a binary file called PLIST, usually simulating an actively used application on the target device.

The malware then initializes itself by taking several steps to decode the data and eventually establishes a session with Google Drive using the built-in OAuth2 credentials.

Once initialized, GIMMICK loads three malicious components: DriveManager, FileManager, in GCDTimerManager. The first component is responsible for managing Google Drive sessions, keeping the local map of the Google Drive directory hierarchy in memory, managing locks for synchronizing tasks in a Google Drive session, and handling uploading and downloading tasks into a Google Drive session.

The hardware UUID of each infected system is used as the identifier of its corresponding Google Drive directory.

The FileManager manages the local directory that stores C&C information and tasks, while the GCDTimerManager takes care of managing the various GCD objects.

Due to the asynchronous nature of malware, command execution requires a phased approach. Although individual steps are executed asynchronously, all commands are executed in the same way.the experts noted.
Apple has also rolled out new protections for all supported versions of macOS with new signatures for XProtect and MRT, which should block and remove malware from March 17, 2022.

Let me remind you that Chinese hackers cover their tracks and remove malware a few days before detection, in tudi to Cynos malware from AppGallery infiltrated at least 9.3 milijonov naprav Android.

Helga Smith

Vedno me je zanimalo računalništvo, zlasti varnost podatkov in tema, ki se dandanes imenuje "znanost o podatkih", že od zgodnjih najstniških let. Pred prihodom v ekipo za odstranjevanje virusov kot glavni urednik, Delal sem kot strokovnjak za kibernetsko varnost v več podjetjih, vključno z enim od Amazonovih izvajalcev. Še ena izkušnja: Poučujem na univerzah Arden in Reading.

Pustite odgovor

To spletno mesto uporablja Akismet za zmanjšanje neželene pošte. Preberite, kako se obdelujejo vaši komentarji.

Gumb Nazaj na vrh