The adversary behind the operation has also been seen utilizing FileZilla servers for malware management and delivery. They are thought to be threat actors from the Commonwealth of Independent States (CIS) who speak Russian. It has been established through additional examination of the disk image files on GitHub and the related infrastructure that the attacks are part of a wider campaign that has been delivering DarkComet RAT, RedLine, Raccoon, Vidar, Rhadamanthys, DanaBot, and Lumma since at least August 2023.

The fact that victims who visit the fraudulent application websites are led to payloads hosted on Bitbucket and Dropbox is another noteworthy aspect of the Rhadamanthys infection pathway. This suggests a wider exploitation of genuine services. The revelation coincides with the statement from the Microsoft Threat Intelligence team that the backdoor on macOS known as Activator, codenamed Exodus, is still a very real threat. It is spread using disk image files that mimic cracked versions of genuine software and collect information from Exodus and Bitcoin-Qt wallet apps.

It disables the Notification Center, switches off the macOS Gatekeeper, and asks the user to grant it enhanced privileges. Next, it adds these malicious scripts to the LaunchAgents folder for persistence and downloads and runs several stages of malicious Python scripts from various command-and-control (C2) domains.

Impact

• Identity Theft
• Sensitive Information Theft
• Financial Loss

Indicators of Compromise

SHA1

• a446e13ce123bbc0e41dc2837503bc5cab8c99ce
• 58b50e0776fb029d0da8efb6affa45c2a908bcc0
• 74dc1cf2a3cd2cb2eb8f3119ec5c0ffda3b7e04b
• 39472719de758d1a9ea90abcb47713436955b0a0
• f595da2ac1a76fe3794025a04001047e6cceb94b
• 089f4f02f0403e5230e51df194d98994a9ac0202
• 87fe07aaee59cda4a671c673c54e08b23cefed60
• a2db69f7015a25bc5776d1db9235c38b8246ecda
• 34c66a2bb9e791dec6156f8bc7a41bf592cf47fd
• 6e4295a4ecc3cfbe3aff0c57eebd4a734bfccf91

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Enable antivirus and anti-malware software and update signature definitions promptly. Using multi-layered protection is necessary to secure vulnerable assets.
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Employ network intrusion detection and prevention systems to monitor and block malicious network activities.
• Implement network segmentation to limit lateral movement for attackers within the network.
• Implement advanced email filtering to detect and block phishing emails.
• Employ updated and robust endpoint protection solutions to detect and block malware.
• Develop and test an incident response plan to ensure a swift and effective response to security incidents.
• Enhance logging and monitoring capabilities to detect anomalous activities and unauthorized access.
• Conduct regular security audits and penetration testing to identify and address potential vulnerabilities.
• Regularly back up critical data and ensure that backup and recovery procedures are in place.