Story image

OceanLotus backdoor targets MacOS systems running PERL

09 Apr 18

The OceanLotus backdoor is now targeting MacOS systems in its latest spate of attacks, and this time it is using a fake event registration form from a Vietnamese organization to do so.

The backdoor is targeting MacOS users who have installed the Perl programming language, according to researchers at Trend Micro.

The backdoor is distributed via an email attachment, which claims to be an event registration form from HDMC, a Vietnam-based organization that advocates democracy and national independence.

“Upon receiving the malicious document, the user is advised to enable macros. In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code.”

They discovered that the payload is written in Perl, suggesting that the backdoor is specifically targeting users with PERL activated.

Once installed, the backdoor can run indefinitely. It is able to collect information about the operating system and allow hackers remote control to the system through the command & control server.

“Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system,” Trend Micro says.

The OceanLotus threat group has been prevalent in Asia and is also known as APT32. The group often targets government and private networks in Vietnam, Cambodia, Laos, and the Philippines.

Last month ESET detected OceanLotus campaigns that mimicked Vietnam telecommunications firm Saigontel. It also detected fake curriculum vitae documents.

The fake documents are used to distribute the backdoor, however the group also uses other methods including fake installers. One installer involved a repackaged Mozilla Firefox installer.

“Multiple layers of in-memory operations and a side-loading technique are used to execute Oceanlotus latest full-featured backdoor,” commented ESET researchers at the time.

They note the the OceanLotus group is skilled at disguising its operations and still manages to convince victims to install the backdoor.

“The encryption of the payload, together with the side-loading technique – despite its age – is a good way to stay under the radar, since the malicious activities look like they come from the legitimate application,” ESET researchers note.

OceanLotus launched Operation Cobalt Kitty last year, which went after an Asian-based firm’s top-level management.

"Ocean Lotus’ activities demonstrate its intention to remain hidden by picking its targets carefully, but ESET’s research has brought to light the true extent of its intended activites,’ ESET concludes.

Twitter suspects state-sponsored ties to support forum breach
One of Twitter’s support forums was hit by a data breach that may have ties to a state-sponsored attack, however users' personal data was exposed.
How McAfee aims to curb enterprise data loss
McAfee DLP aims to help safeguard intellectual property and ensure compliance by protecting sensitive data.
2018 sees 1,500% increase in coinmining malware - report
This issue will only continue to grow as IoT forms the foundation of connected devices and smart city grids.
2019 threat landscape predictions - Proofpoint
Proofpoint researchers have looked ahead at the trends and events likely to shape the threat landscape in the year to come.
Mac malware on WatchGuard’s top ten list for first time
The report is based on data from active WatchGuard Firebox unified threat management appliances and covers the major malware campaigns.
Bin 'em: Those bomb threat emails are complete hoaxes
A worldwide spate of spam emails claiming there is a bomb in the recipient’s building is almost certainly a hoax.
Marriott sets up call centres to answer questions on data breach
Marriott has released an update on the breach of the Starwood guest reservation data breach which affected 500 million guests.
Why there will be a battle for the cloud in 2019
Cloud providers such as AWS, Azure, and Google will likely find themselves in a mad scramble to gain additional enterprise customers.