Story image

OceanLotus backdoor targets MacOS systems running PERL

09 Apr 2018

The OceanLotus backdoor is now targeting MacOS systems in its latest spate of attacks, and this time it is using a fake event registration form from a Vietnamese organization to do so.

The backdoor is targeting MacOS users who have installed the Perl programming language, according to researchers at Trend Micro.

The backdoor is distributed via an email attachment, which claims to be an event registration form from HDMC, a Vietnam-based organization that advocates democracy and national independence.

“Upon receiving the malicious document, the user is advised to enable macros. In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code.”

They discovered that the payload is written in Perl, suggesting that the backdoor is specifically targeting users with PERL activated.

Once installed, the backdoor can run indefinitely. It is able to collect information about the operating system and allow hackers remote control to the system through the command & control server.

“Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system,” Trend Micro says.

The OceanLotus threat group has been prevalent in Asia and is also known as APT32. The group often targets government and private networks in Vietnam, Cambodia, Laos, and the Philippines.

Last month ESET detected OceanLotus campaigns that mimicked Vietnam telecommunications firm Saigontel. It also detected fake curriculum vitae documents.

The fake documents are used to distribute the backdoor, however the group also uses other methods including fake installers. One installer involved a repackaged Mozilla Firefox installer.

“Multiple layers of in-memory operations and a side-loading technique are used to execute Oceanlotus latest full-featured backdoor,” commented ESET researchers at the time.

They note the the OceanLotus group is skilled at disguising its operations and still manages to convince victims to install the backdoor.

“The encryption of the payload, together with the side-loading technique – despite its age – is a good way to stay under the radar, since the malicious activities look like they come from the legitimate application,” ESET researchers note.

OceanLotus launched Operation Cobalt Kitty last year, which went after an Asian-based firm’s top-level management.

"Ocean Lotus’ activities demonstrate its intention to remain hidden by picking its targets carefully, but ESET’s research has brought to light the true extent of its intended activites,’ ESET concludes.

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Ensign and IronNet partner to create cyber analytics capabilities
The Singapore-based joint venture will form a Cyber Analytics Center for Excellence focused on securing regional enterprises from sophisticated cyber threats.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.