Story image

OceanLotus malware proves that MacOS attackers are rapidly honing their craft

04 Jul 17

Despite its low profile, the OceanLotus backdoor for MacOS has become more advanced and more targeted than ever before, after research firm Palo Alto Labs discovered that the latest iteration still remains undetected by most AVs more than a year after it was first detected.

While previous attacks against MacOS have mimicked genuine installers like Adobe Flash, this is one of a few that actually takes Windows-based malware approaches and applies them to MacOS.

The new variety of OceanLotus is housed in a zip file, which may be sent as an email attachment. Recipients who open the attachment and unzip the file are presented with a Word document file, which is actually an application bundle in disguise.

When opening the document, the Trojan launches. it displays a decoy document to mask its launch. The decoy document and application file is named 'noi dung chi tiet', Vietnamese for 'details'.

According to the firm's blog post, the OceanLotus strain is targeted towards Vietnam users and has been significantly improved since it first popped up in 2015.

Researchers say that improvements include decoy documents, stringline coding, no command utilities, custom binary protocol traffic with encryption and a modularized backdoor.

They also suggest that the malware's creator had a difficult task: they needed to trick MacOS into believing the document is an application bundle, despite being a .docx file.

While Apple has updated MacOS protection to address OceanLotus, the increasing complexity of Mac malware suggests that creators are experimenting and honing their craft.

"With this OceanLotus attack in combination with recent macOS versions of the Sofacy group’s toolset, we have now observed multiple espionage motivated threat actors targeting macOS. It is imperative that the same types of strong security practices and policies organizations use to defend Windows devices are applied universally to include macOS devices as well," researchers conclude.

Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.
Using blockchain to ensure regulatory compliance
“Data privacy regulations such as the GDPR require you to put better safeguards in place to protect customer data, and to prove you’ve done it."
A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.