North Korea-linked APT BlueNoroff used new macOS malware ObjCShellz

The North Korea-linked APT BlueNoroff used a new strain of macOS malware strain dubbed ObjCShellz, Jamf Threat Labs reported.

Researchers from Jamf Threat Labs discovered a new macOS malware strain dubbed ObjCShellz and attributed it to North Korea-linked APT BlueNoroff.

The experts noticed that the ObjCShellz malware shares similarities with the RustBucket malware campaign associated with the BlueNoroff APT group. 

The group BlueNoroff is considered a group that operates under the control of the notorious North Korea-linked Lazarus APT group. The APT group’s campaigns focus on cryptocurrency exchanges, venture capital firms, and banks.

The experts discovered a Mach-O universal binary communicating with a domain that they had previously classified as malicious. The executable had a zero detection rate on VirusTotal at the time of its discovery.

The binary is ad-hoc signed that was observed communicating with the domain swissborg[.]blog, which was chosen by the attackers in an attempt to appear as the legitimate cryptocurrency exchange swissborg.com.

The researchers have yet to determine which were the victims of the ObjCShellz attacks, however, the choice of using a domain similar to the one of a legitimate exchange suggests that threat actors targeted an entity or an individual with an interest in the crypto currency sector.

ObjCShellz is written in Objective-C, it is a remote shell that allows attackers to execute commands on the infected systems. Experts believe that the malware is likely being used at a later stage to manually run commands after compromising a system.

“Although fairly simple, this malware is still very functional and will help attackers carry out their objectives. This seems to be a theme with the latest malware we’ve seen coming from this APT group.” concludes the report. “Based on previous attacks performed by BlueNoroff, we suspect that this malware was a late stage within a multi-stage malware delivered via social engineering. Jamf Threat Labs tracks this malware as ObjCShellz and as part of the RustBucket campaign.”

North Korea-linked threat actors continue to target organizations in the cryptocurrency industry to circumvent international sanctions and finance its military operations.

Recently Elastic Security Labs reported that North Korea-linked Lazarus APT group was spotted using new KandyKorn macOS malware in attacks against blockchain engineers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, ObjCShellz)