[ad_1]
A beforehand undocumented cyber-espionage malware geared toward Apple’s macOS working system leveraged a Safari net browser exploit as a part of a watering gap assault concentrating on politically lively, pro-democracy people in Hong Kong.
Slovak cybersecurity agency ESET attributed the intrusion to an actor with “robust technical capabilities,” calling out the marketing campaign’s overlaps to that of an identical digital offensive disclosed by Google Menace Evaluation Group (TAG) in November 2021.
The assault chain concerned compromising a authentic web site belonging to D100 Radio, a pro-democracy web radio station in Hong Kong, to inject malicious inline frames (aka iframes) between September 30 and November 4, 2021.
Within the subsequent part, the tampered code acted as a conduit to load a Mach-O file by leveraging a distant code execution bug in WebKit that was mounted by Apple in February 2021 (CVE-2021-1789). “The exploit used to achieve code execution within the browser is sort of complicated and had greater than 1,000 strains of code as soon as formatted properly,” ESET researchers stated.
The success of the WebKit distant code execution subsequently triggers the execution of the intermediate Mach-O binary that, in flip, exploits a now-patched native privilege escalation vulnerability within the kernel element (CVE-2021-30869) to run the following stage malware as a root consumer.
Whereas the an infection sequence detailed by Google TAG culminated within the set up of an implant known as MACMA, the malware delivered to guests of the D100 Radio web site was a brand new macOS backdoor that ESET has codenamed DazzleSpy.
The malware supplies attackers “a big set of functionalities to regulate, and exfiltrate recordsdata from, a compromised laptop,” the researchers defined, along with incorporating a lot of different options, together with —
- Harvesting system data
- Executing arbitrary shell instructions
- Dumping iCloud Keychain utilizing a CVE-2019-8526 exploit if the macOS model is decrease than 10.14.4
- Beginning or terminating a distant display session, and
- Deleting itself from the machine
“This marketing campaign is similar with one from 2020 the place LightSpy iOS malware (described by Development Micro and Kaspersky) was distributed the identical manner, utilizing iframe injection on web sites for Hong Kong residents resulting in a WebKit exploit,” the researchers stated. That stated, it isn’t instantly clear if each the campaigns had been orchestrated by the identical group.
[ad_2]
