Lazarus Group Builds its First MacOS Malware

Same goals, new tools: Lazarus Group is targeting cryptocurrency exchanges with macOS malware, a sign the nation-state group is developing attacks for a broader variety of platforms to achieve its goal of financial gain.

This is the first case in which Kaspersky Lab researchers spotted Lazarus Group using malware targeting macOS. It seems the group - believed to be out of North Korea - wants to ensure OS platforms don't interfere with infecting targets, so it's building malware for different operating systems. A version of the same malware tailored for Linux is reportedly in the works.

This should serve as a wake-up call for users of non-Windows platforms, researchers note.

Kaspersky Lab discovered the so-called Operation AppleJeus while investigating a cryptocurrency exchange attacked by Lazarus Group. Its target had been hit with a Trojanized cryptocurrency application recommended to the company via email. One employee opened the message and downloaded the third-party app, infecting their machine with an old Lazarus Group tool dubbed Fallchill.

Multiple reports, including one from US-CERT, in the past year have pointed to the reappearance of Fallchill. The malware, a fully functional remote access Trojan, has been leveraged in attacks on the aerospace, finance, and telecommunications industries since 2016. Kaspersky researchers used the appearance of Fallchill in this scenario as a base for attribution to Lazarus Group.

In Operation AppleJeus, the malicious code was pushed in an update to Celas Trade Pro, a cryptocurrency trading app from Celas Limited. The vendor has a valid digital certificate for signing software and legitimate-looking registration records for its domain. However, researchers couldn't find a legitimate business located at the address noted on the certificate.

"When you start looking at bits and pieces behind the application, even that starts looking more and more illegitimate," says Kurt Baumgartner, principal security researcher at Kaspersky Lab.

When someone downloads the app only macOS, a hidden "autoupdater" module is installed in the background to begin immediately after the app is installed and after each system reboot. In most applications, updater components are used to download new program versions.

In the case of AppleJeus, the updater is used to collect information about the target machine and transmit the data back to the command-and-control server. If attackers decide it's worth infecting, they send a software update to install Fallchill. The Trojan provides attackers with "almost unlimited access" to the victim machine, giving them leeway to steal valuable financial data or deploy additional tools to snatch information.

Mac Attack

Lazarus Group developed software to target both the Windows and macOS platforms, and the malware works exactly the same on both operating systems. The extension to macOS is a recent and very narrow trend, Baumgartner notes.

"For the most part we see APT, we see mass exploitations, we see a lot of malware targeting Windows users," he explains. "This is the first time we've seen Lazarus in particular targeting macOS and users."

Why the move to Mac? Baumgartner isn't sure, but he speculates there is a possibility that cryptocurrency traders, and people on the cryptocurrency exchanges, are more interested – "and disproportionately interested" – in using macOS.

"There's no answer as to why, but that is new for them and it is unusual," he points out. Other threat groups, particularly Russian- and Chinese-speaking groups, have previously targeted macOS. It's a new move for Lazarus Group, but this isn't a one-time attack. "They're broadening the platforms they support," he adds. "They're going to continue going after macOS."

Because the Fallchill backdoor and C2 infrastructure have only been associated with the Trojanized cryptocurrency trading app, researchers believe the sole motive is financial gain.

Spotting Slip-ups: Where Lazarus Makes Mistakes

Baumgartner points out how Lazarus Group has a habit of dropping breadcrumbs, which simplify the process of attributing campaigns to the organization. One of the most interesting findings here comes from an additional backdoor hidden in hardcoded headers to communicate with the C2 server.

The Accept-Language HTTP header string revealed a language code associated with North Korea, which researchers say is unusual for malware. It seems the attackers forgot to change something in their developer environment, says Baumgartner.

"They make little mistakes every now and then that give us those insights into what is really behind this activity," he continues. In a previous incident, a malware operator was using multiple IPs connecting between France and Korea, but one short connection was made from an unusual IP range originating in North Korea.

"They do drop breadcrumbs, and these are pretty good breadcrumbs."

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info.