Solve the problem, say "No to MacKeeper!" EVER!
Ping!
The latest Apple/Mac/iOS Pings can be found by searching Keyword "ApplePingList" on FreeRepublic's Search.
If you want on or off the Mac Ping List, Freepmail me
Posted on 02/14/2017 6:28:55 PM PST by Swordmaker
Security researchers found a macOS version of the X-Agent malware used by the APT28 cyberespionage
Security researchers have discovered a macOS malware program that’s likely part of the arsenal used by the Russian cyberespionage group blamed for hacking into the U.S. Democratic National Committee last year.
The group, which is known in the security industry under different names, including Fancy Bear, Pawn Storm, and APT28, has been operating for almost a decade. It is believed to be the sole user and likely developer of a Trojan program called Sofacy or X-Agent.
X-Agent variants for Windows, Linux, Android, and iOS have been found in the wild in the past, but researchers from Bitdefender have now come across what appears to be the first macOS version of the Trojan.
It’s not entirely clear how the malware is being distributed because the Bitdefender researchers only obtained the malware sample, not the full attack chain. However, it’s possible a macOS malware downloader dubbed Komplex, found in September, might be involved.
Komplex infected Macs by exploiting a known vulnerability in the MacKeeper antivirus software, according to researchers from Palo Alto Networks who investigated the malware at the time. The vulnerability allowed attackers to execute remote commands on a Mac when users visited specially crafted webpages.
Palo Alto Networks noted similarities between the Komplex downloader and a variant of the Carberp Trojan that APT28 is also known to have used. The command-and-control domain names used by the Trojan had also been associated with APT28’s activity.
The new X-Agent macOS version uses very similar domain names to the Komplex Trojan, with only their TLD different, the Bitdefender researchers said. There are also identical project path strings inside both the Komplex and X-Agent samples, suggesting they were created by the same author.
The X-Agent malware can load additional modules, which the Bitdefender researchers are still investigating. So far, they’ve found functionality that allows attackers to probe the system for hardware and software configurations, grab a list of running processes, execute additional files, get desktop screenshots, and harvest browser passwords. One module is designed to search for and steal iPhone backups stored on Macs, which can contain further sensitive information about the targeted users.
“Our past analysis of samples known to be linked to the APT28 group shows a number of similarities between the Xagent component for Windows/Linux and the macOS binary that currently forms the object of our investigation,” the Bitdefender researchers said in a blog post. “For one, there is the presence of similar modules, such as FileSystem, KeyLogger, and RemoteShell, as well as a similar network module called HttpChanel.”
APT28 is considered to be one of the most sophisticated and successful cyberespionage groups in the world and it frequently uses zero-day exploits—exploits for previously unknown vulnerabilities. The group has been blamed for many hacking operations around the world over the years, and its selection of targets has frequently reflected Russia’s geopolitical interests. Security researchers believe that the group is likely tied to the Russian Military Intelligence Service (GRU).
Secondly it only works if you were stupid enough to install MacKeeper on your computer, which is malware in and of itself MacKeeper was SUED by 36 Attorney's General two years ago for FRAUD and lost! The trial judge required them to REFUND every penny they had been paid by their customers due to that fraud. DO NOT INSTALL MacKeeper on your Macs! If you have done so, UNINSTALL it immediately!
What election hacks? Evidence or is MacWorld listening to Maxine Waters?
Big Macs?
Macs.
Good, I first thought they were targeting Mars.
The latest Apple/Mac/iOS Pings can be found by searching Keyword "ApplePingList" on FreeRepublic's Search.
If you want on or off the Mac Ping List, Freepmail me
Well, we do have an American flag on Mars. Maxine Waters says it is so.
As I said, "Fake News."
Thank you so much for keeping us Mac users sane under the bombardment of fake news, a.k.a. FUD.
I would like to think that our geeks are better than theirs. For starters they make more money here.
mac ping
Our geeks make big money legally. Their geeks probably make much bigger money illegally. You don’t think these virus and trojan authors and operators of botnets are doing their nefarious work for fun?
Thanks for the article bro.
Do you use Adobe Flash?
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.