Meet 'Fruitfly:' Mac Malware Targeting Biomedical Research Centers

Not far into 2017, and the first Mac malware of the year has made its debut. The malware was brought to our attention by an IT admin who spotted strange outgoing network traffic from a particular Mac. This led to the discovery of a piece of malware unlike anything we’ve seen before, which appears to have actually been in existence undetected for some time, and which seems to be targeting biomedical research centers.

The malware, which we dubbed OSX.Backdoor.Quimitchin, was extremely simplistic on the surface, consisting of only two files: a hidden file and a launch agent. But one thing stood out when we found some truly antique system calls dating back to pre-OS X days. There are several other indications that this malware has been circulating undetected for at least a couple years. For example, a comment in the code indicates that a change was made for Yosemite (Mac OS X 10.10), which was released in October of 2014.

This newly discovered piece of malware can take screen captures and access the webcam via shell commands. Interestingly, it has code to do this both using the Mac and Linux commands, suggesting there might be a Linux variant. It can also receive instructions to perform tasks that include yet another method of capturing the screen, obtaining the screen size and mouse cursor position, changing the mouse position, simulating mouse clicks, and simulating key presses. This component appears to be intended to provide a kind of rudimentary remote control functionality.

We also observed the malware downloading an additional script from its Command and Control server. This script uses the multicast Domain Name System (mDNS) to build a map of all the other devices on the local network, giving information about each device including its IPv6 and IPv4 addresses, name on the network, and the port that is in use. It also appears to be making connection attempts to devices it finds on the network.

The only reason we think this malware hasn’t been spotted before now is that it is being used in tightly targeted attacks, limiting its exposure. There have been a number of stories over the past few years about Chinese and Russian hackers targeting and stealing US and European scientific research. Although there is no evidence at this point linking this malware to a specific group, the fact that it’s been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.

Given the age of some of the code, this malware may go back decades. However, we shouldn’t take the age of the code as too strong an indication of the age of the malware. This could also signify that the hackers behind it really don’t know the Mac very well and were relying on old documentation. It could also be that they’re using old system calls to avoid triggering any kind of behavioral detections that might be expecting more recent code.

Despite the age and sophistication of this malware, it uses the same old unsophisticated technique for persistence that so many other pieces of Mac malware do: a hidden file and a launch agent. This makes it easy to spot, given any reason to look at the infected machine closely (such as unusual network traffic). It also makes it easy to detect and remove.

Apple calls this malware Fruitfly and has released an update that will be automatically downloaded behind the scenes to protect against future infections.

Check out Malwarebytes Labs for a more detailed breakdown of Fruitfly here.