Experts discovered GIMMICK custom malware for macOS

Volexity cybersecurity researchers 發現 a new variant of macOS malware called GIMMICK that is believed to be used by the Chinese cybercriminal group Storm Cloud.

Experts have identified malware in the RAM of a MacBook Pro running macOS 11.6 (Big Sur) that was compromised during a cyber-espionage campaign in late 2021.

GIMMICK is a multi-platform malware written in Objective C (for macOS) or .NET and Delphi (for Windows). All variants of the malware use the same C&C architecture, file paths, behaviours, 和 Google Drive features. Therefore, they are tracked as one tool, despite the differences in the code.

GIMMICK is run either directly by the user or as a daemon on the system, and is installed as a binary file called PLIST, usually simulating an actively used application on the target device.

The malware then initializes itself by taking several steps to decode the data and eventually establishes a session with Google Drive using the built-in OAuth2 credentials.

Once initialized, GIMMICK loads three malicious components: DriveManager, FileManager, 和 GCDTimerManager. The first component is responsible for managing Google Drive sessions, keeping the local map of the Google Drive directory hierarchy in memory, managing locks for synchronizing tasks in a Google Drive session, and handling uploading and downloading tasks into a Google Drive session.

The hardware UUID of each infected system is used as the identifier of its corresponding Google Drive directory.

The FileManager manages the local directory that stores C&C information and tasks, while the GCDTimerManager takes care of managing the various GCD objects.

Let me remind you that Chinese hackers cover their tracks and remove malware a few days before detection, and also that Cynos malware from AppGallery infiltrated at least 9.3 million Android devices.