Story image

OceanLotus backdoor targets MacOS systems running PERL

09 Apr 2018

The OceanLotus backdoor is now targeting MacOS systems in its latest spate of attacks, and this time it is using a fake event registration form from a Vietnamese organization to do so.

The backdoor is targeting MacOS users who have installed the Perl programming language, according to researchers at Trend Micro.

The backdoor is distributed via an email attachment, which claims to be an event registration form from HDMC, a Vietnam-based organization that advocates democracy and national independence.

“Upon receiving the malicious document, the user is advised to enable macros. In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code.”

They discovered that the payload is written in Perl, suggesting that the backdoor is specifically targeting users with PERL activated.

Once installed, the backdoor can run indefinitely. It is able to collect information about the operating system and allow hackers remote control to the system through the command & control server.

“Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system,” Trend Micro says.

The OceanLotus threat group has been prevalent in Asia and is also known as APT32. The group often targets government and private networks in Vietnam, Cambodia, Laos, and the Philippines.

Last month ESET detected OceanLotus campaigns that mimicked Vietnam telecommunications firm Saigontel. It also detected fake curriculum vitae documents.

The fake documents are used to distribute the backdoor, however the group also uses other methods including fake installers. One installer involved a repackaged Mozilla Firefox installer.

“Multiple layers of in-memory operations and a side-loading technique are used to execute Oceanlotus latest full-featured backdoor,” commented ESET researchers at the time.

They note the the OceanLotus group is skilled at disguising its operations and still manages to convince victims to install the backdoor.

“The encryption of the payload, together with the side-loading technique – despite its age – is a good way to stay under the radar, since the malicious activities look like they come from the legitimate application,” ESET researchers note.

OceanLotus launched Operation Cobalt Kitty last year, which went after an Asian-based firm’s top-level management.

"Ocean Lotus’ activities demonstrate its intention to remain hidden by picking its targets carefully, but ESET’s research has brought to light the true extent of its intended activites,’ ESET concludes.

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.