SlideShare a Scribd company logo

Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS

•
•
M
MITRE ATT&CK

From ATT&CKcon 4.0 By Marina Liang "LABYRINTH CHOLLIMA is a prolific Democratic People's Republic of Korea (DPRK) nexus adversary focused on cyber espionage. They have been recently observed targeting FinTech (financial technology) companies in cryptocurrency revenue generation efforts. LABYRINTH CHOLLIMA has been associated with many high profile attacks, including the Sony Pictures Entertainment (SPE) breach, the WannaCry 2.0 global surge, and most recently, the 3CX supply chain compromise. Increasingly versed in cross-platform intrusions, LABYRINTH CHOLLIMA has been observed targeting macOS operating systems, and evolving their tactics, techniques, and tooling to keep in lockstep with the evolving security landscape. This talk will deep dive into the interactive macOS intrusions Crowdstrike has attributed to LABYRINTH CHOLLIMA. We will delve into the adversary's macOS tradecraft, techniques to circumvent existing OS protections, and social engineering tactics, while showcasing how their mechanisms and tooling map to the MITRE ATT&CK kill chain, featuring some newly proposed MITRE techniques related to the Transparency, Consent, and Control (TCC) database."

Technology
1 of 26
Download to read offline
Marina Liang, Threat Researcher Exploring the Labyrinth Deep dive into the Lazarus Group’s foray into macOS 1
Agenda Follow me down the labyrinth… • Whoami • Overview of Lazarus Group • Foray into macOS • New(ish) macOS techniques: • TCC db • Ad hoc signing • Lazarus Group Mitre Heat Map • Recommendations for Defenders • Predictions • Q&A 2
whoami Marina Liang • Independent Security Researcher - open to connecting ;) • 7 years in InfoSec with a focus on Windows + macOS • EDR vendors: Carbon Black, Crowdstrike • Background: Threat research, MDR, threat hunting, SecOps, EDR, purple teaming, IR, detection engineering • Active with Mitre ATT&CK community: • Windows Phantom DLL Hijacking - NEW • macOS TCC.db dumping (2) - NEW • Hobbies: Dance, yoga, art, travel, eating • LinkedIn: https://www.linkedin.com/in/marinaliang 3
Overview of Lazarus Group Aka Labyrinth Chollima, HIDDEN COBRA, etc. • https://attack.mitre.org/groups/G0032/ • Origin: DPRK (Democratic People’s Republic of Korea) • Active since at least 2009 • Breaches: Sony, WannaCry, 3CX, JumpCloud • Targeted OS: Cross-platform - Windows, macOS, Linux, and…Cloud! • Motivation: Cyber espionage + currency generation • Targeted Verticals: Various, aerospace & defense, recent emphasis on FinTech (crypto) • Estimates of $2B in crypto-currency stolen • Targeted Geography: Various, South Korea, Europe, US 4
LAZARUS GROUP: FORAY into macOS 5
Evolution of Social Engineering Tactics Lazarus Group Demonstrates Targeted Social Engineering https://www.malwarebytes.com/blog/news/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/ 2019 - COVID Pandemic begin s • 2020- Targeted AstraZenec a • possibly to gain insights into COVID-19 for DPR K • Extortion or selling info for profit 2020-2021 - Targeting cyber security researcher s • Fake security compan y • Posed as security recruiters/ researchers 2021-2022 - Operation In(ter)ception • Decoy PDF lures for job vacancies at Coinbase and crypto.com • Cyber espionage + currency generation 2023: Continued job lure s • Recession themed? • Fake recruiter advertising jobs for a real or fake compan y • Sends them “interview questions” or “job description” to prep Social engineering themes change with existing geopolitical and socioeconomic time s Platforms: LinkedIn, Twitter, WhatsApp, Slack, Telegram, Discord, Keybase and email. 6 2019-2020 - Operation Dream Jo b • Targeted aerospace and defense, primarily in Eastern Europe • Cyber espionage
Lazarus Tools If it ain’t broke, don’t fix it Notable Tool and Strategy Reuse : • Cryptocurrency trading program and fake crypto company + website hosting malwar e • AppleJeus (numerous iterations) - fake installer and macOS malware for cryptocurrency exchange • Persistence: Postinstall script installs malware as a launch daemon, extracting a hidden plist from the application’s /Resources directory. • Requires a single command-line argument in order to execute - likely to bypass ED R • Signed but not with a Apple developer ID https://objective-see.org/blog/blog_0x49.html 7
Lazarus Tools: MATA & Masquerading Custom cross-platform remote access tool MATANet or MATA Framework or DACLS was a custom tool developed by Lazarus Group back around 2018. Though initially developed for other OS’s, Lazarus has since pivoted to macOS. • Various geographic targets: US, Poland, Germany, Turkey, Korea, Japan and India, and counting Masquerading MATA Framework implants and variants pose as common apps: • Adobe, Google Chrome, Oracle, fonts, Zoom, developer packages (fiddler, ruby gems), PyPi packages, etc. • macOS and Linux variants leverage plugins https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ 8
Evolution of MATA: macOS Custom cross-platform remote access tool https://blogs.vmware.com/security/2022/11/threat-analysis-active-c2-discovery-using-protocol-emulation-part4-dacls-aka-mata.html https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ April 2018: MATA first seen in the wild - Windows and Linux - reported by 360 Netlab 2020-2022: VMware Threat Analysis Unit (TAU) scans the internet for MATA C2 servers, resulting in 121 active servers uncovered, with numbers declining. 2023: Developer package Masquerading: • Fake install.rb in /Library/Ruby/ Gems/ 2.6.0/extensions/ • Fake Bundler Ruby gem bundler.rb in / Library/Ruby/Gems/2.6.0/extensions/ • .rb files do not reside in / extensions/ 9 2020:First observed macOS variant on VT - Trojanized 2FA APP based on an open- source 2FA app, MinaOTP • Impersonating developer files “Contents/ Resources/Base.lproj/” • Fake SubMenu.nib (Mac executable file) Note: There are not a ton of MATA macOS samples out there, so happy to collaborate to augment this timeline.
macOS RMM tools *macOS admins collectively cringe* JumpCloud supply chain attack 2023 - Targeted customers in the cryptocurrency industry - Lazarus Group uses JumpCloud to deploy ruby scripts and drop Mach-O executables and malware onto victim hosts - Access to existing infrastructure… Why use JumpCloud? - Permissions: Admin tools like Jamf and JumpCloud run with the required privileges to execute scripts and enumerate sensitive files - Easy to blend in - Noisy - difficult to tune out “what is normal” ⁃ https://www.mandiant.com/resources/blog/north-korea-supply-chain ⁃ https://jumpcloud.com/blog/security-update-june-20-incident-details-and-remediation 10
LAZARUS GROUP: RECENT TTPs 11
Primer on TCC.db Transparency, Consent, Control (TCC) TCC framework: Security and privacy controls to prevent applications from being able to access sensitive data without user permission • Permissions include: full disk, camera, contacts and microphone acces s • If an application tries to access files protected by TCC without authorization, the operation is denied. Location: •global: (/Library/Application Support/com.apple.TCC/TCC.db) •user: ($HOME/Library/Application Support/com.apple.TCC/ TCC.db) •If you are an admin, if you grant yourself FDA, you grant all users (even non- admins) the ability to read all other users’ data on the disk, including your own . • As reported in CVE-2020-9771: A disk can be mounted and read by non- admin user s • If an actor copies malware over to the app bundle that already has TCC permissions with the right access, that app will execute 12 https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/
TCC.db - what could go wrong? Lazarus Group dumps the TCC.db If an actor gains write access to the TCC.db, they could grant themselves TCC entitlements without alerting the user. System Integrity Protection (SIP) is supposed to mitigate this, BUT terminal could already have FDA enabled . Lazarus dumps the Transparency, Consent and Control (TCC) database . • The output of this dump would present a gold mine of possible applications to exploit: • What has FDA ? • What apps are allowed to access which service s • Any code-signing requirement data (csreq ) CMD: /bin/bash -c sqlite3 /Library/Application Support/com.apple.TCC/TCC.db '.dump access’ Some EDR/NGAV block this already, so Lazarus is likely to pivot … If Lazarus is blocked, it’s possible they could use SELECT instead of DUMP : •sudo sqlite3 /Library/Application Support/com.apple.TCC/TCC.db “SELECT client, allowed FROM access where service == ‘kTCCServiceSystemPolicyAllFiles’” | grep ‘1’$ 13
Threat Hunting for TCC.db Mischief Experiment #1 with VT… • Query:(type:dmg or type:macho) and behavior:".dump access” - No hits :( • Query: behaviour_processes:”bash -c sqlite3” - Also no hits… :( :( • Cast a wide net: behaviour_processes:”TCC.db" - JACKPOT - 29 hits, approximately 40% confirmed malware
Lazarus CloudMensis Campaign Threat Hunting for TCC.db Mischief
Threat Hunting for TCC.db Mischief Bundlore copies the TCC.db too!
Threat Hunting for TCC.db mischief Experiment #1 with VT… Takeaways from VT hunting • macOS malware authors including Lazarus have been exploiting the TCC.db for a couple of years (Bundlore, Cloudmensis, XCSSET malware) • Copying, dumping, writing to/inserting • Lazarus likely decoupling malware from commands to perform TCC.db operations (HOK, signature evasion) • Not many apps should be interacting with the TCC.db - detection opp!
Adhoc Signing Signing without actual certificates ⁃ Intel and Apple silicon architectures handle code signing requirements differently ⁃ M1 Macs are the first apple computers restricted from running unsigned code “New in macOS 11 on Apple Silicon Mac computers, and starting in next macOS Big Sur 11 beta, the operating system will enforce that any executable must be signed with a valid signature before it’s allowed to run.” HOWEVER “There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long- established policy that our users and developers can run arbitrary code on their Macs, and is designed to simplify the execution policies on Apple silicon Mac computers and enable the system to better detect code modifications.” Additionally… “This new policy doesn’t apply to translated x86 binaries running under Rosetta, nor does it apply to macOS 11 running on Intel platforms” - Apple in WWDC 2020 https://developer.apple.com/documentation/security/seccodesignatureflags/1397793-adhoc https://wiki.lazarus.freepascal.org/Code_Signing_for_macOS https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/ 18
Adhoc signing Bypassing Gatekeeper Lazarus has historically used unsigned or ad hoc signed binaries • Observed ad hoc signing via command line directly on the target host: CMD: codesign --force -s - [name of file or app] • A hyphen for the identity makes it an ad hoc signature with no certificate. Check the validity of an ad hoc signed executable with: CMD: codesign -dv -r- UpdateAgent 19
Threat Hunting for adhoc signed files Experiment #2 with VT Some Mixed Takeaways: • VT search does not delineate ad hoc signed and only classifies as not signed • Lots of mach-O files are unsigned • Lots of crypto-related mach-O files are unsigned • Yara rule is probably better bet here
Previously observed adhoc signed samples Operation In(ter)ception: These binaries are universal Mach-Os and can run on Intel or M1 Apple silicon machines. They are signed with an adhoc signature, meaning that they will bypass Apple’s Gatekeeper without a recognized developer identity. 21
Recent adhoc Signed Malware: Rustbucket Multiple variants in 2023 - indicates continuous innovation • Malware written in Rust isn’t very commo n • In May 2023, a second RustBucket variant was observed targeting macOS users . • In June 2023, a third variant included new persistence capabilities. 22
Mitre Mapping - Lazarus Group x macOS A synopsis of the TTPs covered today (in green) • Note1: TCC dumping and writing are not currently released (future ATT&CK version)! • Note2: Adhoc signing may arguably be a separate technique - new submission pending! 23
Predictions for Lazarus They’re not going anywhere… •Lazarus will continue to evade analysis •Chunking malware into multiple stages •Leverage command line to evade file-based signatures • RUSTBUCKET malware will continue to evolve •Social engineering via LinkedIn will increase with likely recession in 2024 •Lazarus will continue their crypto and crypto-adjacent industry targeting (gaming) •Exploitation of commercial macOS admin tools will continue •Bypassing or disabling macOS security features will continue •Pay attention to WWDC 23, 24, 25, etc. • Lazarus will pivot if blocked from TCC.db dumping 24
Recommendations for Blue Teamers Keep Calm and Enable Default macOS protections • Gatekeeper and SIP should be on by default for macOS. • Monitor for disabling of Gatekeeper and SIP, and implement automated re-enabling of these protections. • Security practitioners can automate via spctl and csrutil to re-enable Gatekeeper and SIP, respectively. • Pay special attention if you are in the crypto/crypto adjacent industry • Audit for shadow IT, especially unsanctioned macOS RMM tools • Baseline your environment • Deploy EDR everywhere • Least privilege always applies: Be judicious in what you grant permissions to. 25
Special Thank You to: Couldn’t have done it without…. • The macOS cyber community <3 • Mitre for having me :) 26

Recommended

.LNK Tears of the Kingdom
.LNK Tears of the Kingdom.LNK Tears of the Kingdom
.LNK Tears of the KingdomMITRE ATT&CK
 
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...MITRE ATT&CK
 
CISA usage of ATT&CK in Cybersecurity Advisories
CISA usage of ATT&CK in Cybersecurity AdvisoriesCISA usage of ATT&CK in Cybersecurity Advisories
CISA usage of ATT&CK in Cybersecurity AdvisoriesMITRE ATT&CK
 
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CKOne Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CKMITRE ATT&CK
 
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CKGrow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CKMITRE ATT&CK
 
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...MITRE ATT&CK
 
MITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK based Threat Analysis for Electronic Flight BagMITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK based Threat Analysis for Electronic Flight BagMITRE ATT&CK
 
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
Evaluating and Enhancing Security Maturity through MITRE ATT&CK MappingEvaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
Evaluating and Enhancing Security Maturity through MITRE ATT&CK MappingMITRE ATT&CK
 

Recommended

.LNK Tears of the Kingdom
.LNK Tears of the Kingdom.LNK Tears of the Kingdom
.LNK Tears of the KingdomMITRE ATT&CK
 
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...MITRE ATT&CK
 
CISA usage of ATT&CK in Cybersecurity Advisories
CISA usage of ATT&CK in Cybersecurity AdvisoriesCISA usage of ATT&CK in Cybersecurity Advisories
CISA usage of ATT&CK in Cybersecurity AdvisoriesMITRE ATT&CK
 
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CKOne Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CKMITRE ATT&CK
 
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CKGrow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CKMITRE ATT&CK
 
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...MITRE ATT&CK
 
MITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK based Threat Analysis for Electronic Flight BagMITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK based Threat Analysis for Electronic Flight BagMITRE ATT&CK
 
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
Evaluating and Enhancing Security Maturity through MITRE ATT&CK MappingEvaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
Evaluating and Enhancing Security Maturity through MITRE ATT&CK MappingMITRE ATT&CK
 
Updates from the Center for Threat-Informed Defense
Updates from the Center for Threat-Informed DefenseUpdates from the Center for Threat-Informed Defense
Updates from the Center for Threat-Informed DefenseMITRE ATT&CK
 
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR TelemetryTidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR TelemetryMITRE ATT&CK
 
ATT&CKcon Intro
ATT&CKcon IntroATT&CKcon Intro
ATT&CKcon IntroMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)MITRE ATT&CK
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueWill Schroeder
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKMITRE ATT&CK
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesJorge Orchilles
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
ATT&CKING Containers in The Cloud
ATT&CKING Containers in The CloudATT&CKING Containers in The Cloud
ATT&CKING Containers in The CloudMITRE ATT&CK
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorAutomating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 
Catch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkCatch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkDefCamp
 
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme... هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...M Mehdi Ahmadian
 

More Related Content

What's hot

Updates from the Center for Threat-Informed Defense
Updates from the Center for Threat-Informed DefenseUpdates from the Center for Threat-Informed Defense
Updates from the Center for Threat-Informed DefenseMITRE ATT&CK
 
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR TelemetryTidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR TelemetryMITRE ATT&CK
 
ATT&CKcon Intro
ATT&CKcon IntroATT&CKcon Intro
ATT&CKcon IntroMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)MITRE ATT&CK
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentTeymur Kheirkhabarov
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueWill Schroeder
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKMITRE ATT&CK
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK frameworkBhushan Gurav
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesJorge Orchilles
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
ATT&CKING Containers in The Cloud
ATT&CKING Containers in The CloudATT&CKING Containers in The Cloud
ATT&CKING Containers in The CloudMITRE ATT&CK
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorAutomating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorMITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 

What's hot (20)

Updates from the Center for Threat-Informed Defense
Updates from the Center for Threat-Informed DefenseUpdates from the Center for Threat-Informed Defense
Updates from the Center for Threat-Informed Defense
 
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR TelemetryTidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
 
ATT&CKcon Intro
ATT&CKcon IntroATT&CKcon Intro
ATT&CKcon Intro
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
 
Hunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows EnvironmentHunting for Privilege Escalation in Windows Environment
Hunting for Privilege Escalation in Windows Environment
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
Catch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs BlueCatch Me If You Can: PowerShell Red vs Blue
Catch Me If You Can: PowerShell Red vs Blue
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
 
ATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CKATT&CK Updates- Defensive ATT&CK
ATT&CK Updates- Defensive ATT&CK
 
MITRE ATT&CK framework
MITRE ATT&CK frameworkMITRE ATT&CK framework
MITRE ATT&CK framework
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
 
ATT&CKING Containers in The Cloud
ATT&CKING Containers in The CloudATT&CKING Containers in The Cloud
ATT&CKING Containers in The Cloud
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorAutomating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections Collector
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
 

Similar to Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS

Catch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkCatch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkDefCamp
 
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme... هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...M Mehdi Ahmadian
 
Jesse Burke RDPwned HackMiami7
Jesse Burke RDPwned HackMiami7Jesse Burke RDPwned HackMiami7
Jesse Burke RDPwned HackMiami7Jesse Burke
 
Order vs. Mad Science: Analyzing Black Hat Swarm Intelligence
Order vs. Mad Science: Analyzing Black Hat Swarm IntelligenceOrder vs. Mad Science: Analyzing Black Hat Swarm Intelligence
Order vs. Mad Science: Analyzing Black Hat Swarm IntelligencePriyanka Aash
 
How to measure your security response readiness?
How to measure your security response readiness?How to measure your security response readiness?
How to measure your security response readiness?Tomasz Jakubowski
 
Top 10 Threats to Cloud Security
Top 10 Threats to Cloud SecurityTop 10 Threats to Cloud Security
Top 10 Threats to Cloud SecuritySBWebinars
 
Open source building blocks for the Internet of Things - Jfokus 2013
Open source building blocks for the Internet of Things - Jfokus 2013Open source building blocks for the Internet of Things - Jfokus 2013
Open source building blocks for the Internet of Things - Jfokus 2013Benjamin CabĂŠ
 
【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】
【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】
【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】Hacks in Taiwan (HITCON)
 
Computer Network Case Study - bajju.pptx
Computer Network Case Study - bajju.pptxComputer Network Case Study - bajju.pptx
Computer Network Case Study - bajju.pptxShivamBajaj36
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomwareSophos Benelux
 
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgileNetwork
 
Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3Kabul Education University
 
Mobile application security and threat modeling
Mobile application security and threat modelingMobile application security and threat modeling
Mobile application security and threat modelingShantanu Mitra
 
Analysis of RSA Lockheed Martin Attack
Analysis of RSA Lockheed Martin AttackAnalysis of RSA Lockheed Martin Attack
Analysis of RSA Lockheed Martin AttackGavin Davey
 
Talk28oct14
Talk28oct14Talk28oct14
Talk28oct14mjos
 
Nomura UCCSC 2009
Nomura UCCSC 2009Nomura UCCSC 2009
Nomura UCCSC 2009dnomura
 
Case Study of RSA Data Breach
Case Study of RSA Data BreachCase Study of RSA Data Breach
Case Study of RSA Data BreachKunal Sharma
 
Security on Cloud Computing
Security on Cloud Computing Security on Cloud Computing
Security on Cloud Computing Reza Pahlava
 

Similar to Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS (20)

Catch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your networkCatch Me If You Can - Finding APTs in your network
Catch Me If You Can - Finding APTs in your network
 
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme... هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
هک پایگاه داده و راهکارهای مقابلهDatabases hacking, safeguards and counterme...
 
Jesse Burke RDPwned HackMiami7
Jesse Burke RDPwned HackMiami7Jesse Burke RDPwned HackMiami7
Jesse Burke RDPwned HackMiami7
 
Order vs. Mad Science: Analyzing Black Hat Swarm Intelligence
Order vs. Mad Science: Analyzing Black Hat Swarm IntelligenceOrder vs. Mad Science: Analyzing Black Hat Swarm Intelligence
Order vs. Mad Science: Analyzing Black Hat Swarm Intelligence
 
How to measure your security response readiness?
How to measure your security response readiness?How to measure your security response readiness?
How to measure your security response readiness?
 
Top 10 Threats to Cloud Security
Top 10 Threats to Cloud SecurityTop 10 Threats to Cloud Security
Top 10 Threats to Cloud Security
 
Open source building blocks for the Internet of Things - Jfokus 2013
Open source building blocks for the Internet of Things - Jfokus 2013Open source building blocks for the Internet of Things - Jfokus 2013
Open source building blocks for the Internet of Things - Jfokus 2013
 
【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】
【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】
【HITCON FreeTalk 2021 - SolarWinds 供應鏈攻擊事件分析】
 
Computer Network Case Study - bajju.pptx
Computer Network Case Study - bajju.pptxComputer Network Case Study - bajju.pptx
Computer Network Case Study - bajju.pptx
 
How to stay protected against ransomware
How to stay protected against ransomwareHow to stay protected against ransomware
How to stay protected against ransomware
 
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh ShregillAgile Network India | DevSecOps - The What and the Why | Ritesh Shregill
Agile Network India | DevSecOps - The What and the Why | Ritesh Shregill
 
Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3Cryptography and Network security # Lecture 3
Cryptography and Network security # Lecture 3
 
Mobile application security and threat modeling
Mobile application security and threat modelingMobile application security and threat modeling
Mobile application security and threat modeling
 
Analysis of RSA Lockheed Martin Attack
Analysis of RSA Lockheed Martin AttackAnalysis of RSA Lockheed Martin Attack
Analysis of RSA Lockheed Martin Attack
 
Botnets Attacks.pptx
Botnets Attacks.pptxBotnets Attacks.pptx
Botnets Attacks.pptx
 
News bytes Sept-2011
News bytes Sept-2011News bytes Sept-2011
News bytes Sept-2011
 
Talk28oct14
Talk28oct14Talk28oct14
Talk28oct14
 
Nomura UCCSC 2009
Nomura UCCSC 2009Nomura UCCSC 2009
Nomura UCCSC 2009
 
Case Study of RSA Data Breach
Case Study of RSA Data BreachCase Study of RSA Data Breach
Case Study of RSA Data Breach
 
Security on Cloud Computing
Security on Cloud Computing Security on Cloud Computing
Security on Cloud Computing
 

More from MITRE ATT&CK

Dealing With ATT&CK's Different Levels Of Detail
Dealing With ATT&CK's Different Levels Of DetailDealing With ATT&CK's Different Levels Of Detail
Dealing With ATT&CK's Different Levels Of DetailMITRE ATT&CK
 
Automating testing by implementing ATT&CK using the Blackboard Architecture
Automating testing by implementing ATT&CK using the Blackboard ArchitectureAutomating testing by implementing ATT&CK using the Blackboard Architecture
Automating testing by implementing ATT&CK using the Blackboard ArchitectureMITRE ATT&CK
 
I can haz cake: Benefits of working with MITRE on ATT&CK
I can haz cake: Benefits of working with MITRE on ATT&CKI can haz cake: Benefits of working with MITRE on ATT&CK
I can haz cake: Benefits of working with MITRE on ATT&CKMITRE ATT&CK
 
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)MITRE ATT&CK
 
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...MITRE ATT&CK
 
MITRE ATT&CK Updates: State of the Cloud
MITRE ATT&CK Updates: State of the CloudMITRE ATT&CK Updates: State of the Cloud
MITRE ATT&CK Updates: State of the CloudMITRE ATT&CK
 
Using ATT&CK to created wicked actors in real data
Using ATT&CK to created wicked actors in real dataUsing ATT&CK to created wicked actors in real data
Using ATT&CK to created wicked actors in real dataMITRE ATT&CK
 
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...MITRE ATT&CK
 
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...MITRE ATT&CK
 
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...MITRE ATT&CK
 
MITRE ATT&CK Updates: ICS
MITRE ATT&CK Updates: ICSMITRE ATT&CK Updates: ICS
MITRE ATT&CK Updates: ICSMITRE ATT&CK
 
The case for quishing
The case for quishingThe case for quishing
The case for quishingMITRE ATT&CK
 
Discussion on Finding Relationships in Cyber Data
Discussion on Finding Relationships in Cyber DataDiscussion on Finding Relationships in Cyber Data
Discussion on Finding Relationships in Cyber DataMITRE ATT&CK
 
The art of communicating ATT&CK to the CFO
The art of communicating ATT&CK to the CFOThe art of communicating ATT&CK to the CFO
The art of communicating ATT&CK to the CFOMITRE ATT&CK
 
Cloud Native Workload ATT&CK Matrix
Cloud Native Workload ATT&CK MatrixCloud Native Workload ATT&CK Matrix
Cloud Native Workload ATT&CK MatrixMITRE ATT&CK
 
MITRE ATT&CK Updates: Software
MITRE ATT&CK Updates: SoftwareMITRE ATT&CK Updates: Software
MITRE ATT&CK Updates: SoftwareMITRE ATT&CK
 
Or Lenses and Layers: Adding Business Context to Enterprise Mappings
Or Lenses and Layers: Adding Business Context to Enterprise MappingsOr Lenses and Layers: Adding Business Context to Enterprise Mappings
Or Lenses and Layers: Adding Business Context to Enterprise MappingsMITRE ATT&CK
 
Adjectives for ATT&CK
Adjectives for ATT&CKAdjectives for ATT&CK
Adjectives for ATT&CKMITRE ATT&CK
 
Threat Modelling - It's not just for developers
Threat Modelling - It's not just for developersThreat Modelling - It's not just for developers
Threat Modelling - It's not just for developersMITRE ATT&CK
 

More from MITRE ATT&CK (19)

Dealing With ATT&CK's Different Levels Of Detail
Dealing With ATT&CK's Different Levels Of DetailDealing With ATT&CK's Different Levels Of Detail
Dealing With ATT&CK's Different Levels Of Detail
 
Automating testing by implementing ATT&CK using the Blackboard Architecture
Automating testing by implementing ATT&CK using the Blackboard ArchitectureAutomating testing by implementing ATT&CK using the Blackboard Architecture
Automating testing by implementing ATT&CK using the Blackboard Architecture
 
I can haz cake: Benefits of working with MITRE on ATT&CK
I can haz cake: Benefits of working with MITRE on ATT&CKI can haz cake: Benefits of working with MITRE on ATT&CK
I can haz cake: Benefits of working with MITRE on ATT&CK
 
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)
 
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
 
MITRE ATT&CK Updates: State of the Cloud
MITRE ATT&CK Updates: State of the CloudMITRE ATT&CK Updates: State of the Cloud
MITRE ATT&CK Updates: State of the Cloud
 
Using ATT&CK to created wicked actors in real data
Using ATT&CK to created wicked actors in real dataUsing ATT&CK to created wicked actors in real data
Using ATT&CK to created wicked actors in real data
 
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
MITRE ATT&CK Updates: New Ideas in Enterprise - Pushing the boundaries of ATT...
 
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
 
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
 
MITRE ATT&CK Updates: ICS
MITRE ATT&CK Updates: ICSMITRE ATT&CK Updates: ICS
MITRE ATT&CK Updates: ICS
 
The case for quishing
The case for quishingThe case for quishing
The case for quishing
 
Discussion on Finding Relationships in Cyber Data
Discussion on Finding Relationships in Cyber DataDiscussion on Finding Relationships in Cyber Data
Discussion on Finding Relationships in Cyber Data
 
The art of communicating ATT&CK to the CFO
The art of communicating ATT&CK to the CFOThe art of communicating ATT&CK to the CFO
The art of communicating ATT&CK to the CFO
 
Cloud Native Workload ATT&CK Matrix
Cloud Native Workload ATT&CK MatrixCloud Native Workload ATT&CK Matrix
Cloud Native Workload ATT&CK Matrix
 
MITRE ATT&CK Updates: Software
MITRE ATT&CK Updates: SoftwareMITRE ATT&CK Updates: Software
MITRE ATT&CK Updates: Software
 
Or Lenses and Layers: Adding Business Context to Enterprise Mappings
Or Lenses and Layers: Adding Business Context to Enterprise MappingsOr Lenses and Layers: Adding Business Context to Enterprise Mappings
Or Lenses and Layers: Adding Business Context to Enterprise Mappings
 
Adjectives for ATT&CK
Adjectives for ATT&CKAdjectives for ATT&CK
Adjectives for ATT&CK
 
Threat Modelling - It's not just for developers
Threat Modelling - It's not just for developersThreat Modelling - It's not just for developers
Threat Modelling - It's not just for developers
 

Recently uploaded

Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...shyamraj55
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsMemoori
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 3652toLead Limited
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr LapshynFwdays
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGMarianaLemus7
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Scott Keck-Warren
 
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024BookNet Canada
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024Scott Keck-Warren
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesSinan KOZAK
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxOnBoard
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking MenDelhi Call girls
 
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptxMaking_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptxnull - The Open Security Community
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonetsnaman860154
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Mattias Andersson
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphNeo4j
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticscarlostorres15106
 

Recently uploaded (20)

Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
Automating Business Process via MuleSoft Composer | Bangalore MuleSoft Meetup...
 
AI as an Interface for Commercial Buildings
AI as an Interface for Commercial BuildingsAI as an Interface for Commercial Buildings
AI as an Interface for Commercial Buildings
 
The transition to renewables in India.pdf
The transition to renewables in India.pdfThe transition to renewables in India.pdf
The transition to renewables in India.pdf
 
Streamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project SetupStreamlining Python Development: A Guide to a Modern Project Setup
Streamlining Python Development: A Guide to a Modern Project Setup
 
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
Tech-Forward - Achieving Business Readiness For Copilot in Microsoft 365
 
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
"Federated learning: out of reach no matter how close",Oleksandr Lapshyn
 
Pigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food ManufacturingPigging Solutions in Pet Food Manufacturing
Pigging Solutions in Pet Food Manufacturing
 
APIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDGAPIForce Zurich 5 April Automation LPDG
APIForce Zurich 5 April Automation LPDG
 
Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024Advanced Test Driven-Development @ php[tek] 2024
Advanced Test Driven-Development @ php[tek] 2024
 
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
New from BookNet Canada for 2024: BNC BiblioShare - Tech Forum 2024
 
SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024SQL Database Design For Developers at php[tek] 2024
SQL Database Design For Developers at php[tek] 2024
 
Unblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen FramesUnblocking The Main Thread Solving ANRs and Frozen Frames
Unblocking The Main Thread Solving ANRs and Frozen Frames
 
Maximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptxMaximizing Board Effectiveness 2024 Webinar.pptx
Maximizing Board Effectiveness 2024 Webinar.pptx
 
Vulnerability_Management_GRC_by Sohang Sengupta.pptx
Vulnerability_Management_GRC_by Sohang Sengupta.pptxVulnerability_Management_GRC_by Sohang Sengupta.pptx
Vulnerability_Management_GRC_by Sohang Sengupta.pptx
 
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
08448380779 Call Girls In Diplomatic Enclave Women Seeking Men
 
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptxMaking_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
Making_way_through_DLL_hollowing_inspite_of_CFG_by_Debjeet Banerjee.pptx
 
How to convert PDF to text with Nanonets
How to convert PDF to text with NanonetsHow to convert PDF to text with Nanonets
How to convert PDF to text with Nanonets
 
Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?Are Multi-Cloud and Serverless Good or Bad?
Are Multi-Cloud and Serverless Good or Bad?
 
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge GraphSIEMENS: RAPUNZEL – A Tale About Knowledge Graph
SIEMENS: RAPUNZEL – A Tale About Knowledge Graph
 
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmaticsKotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
Kotlin Multiplatform & Compose Multiplatform - Starter kit for pragmatics
 

Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS

  • 1. Marina Liang, Threat Researcher Exploring the Labyrinth Deep dive into the Lazarus Group’s foray into macOS 1
  • 2. Agenda Follow me down the labyrinth… • Whoami • Overview of Lazarus Group • Foray into macOS • New(ish) macOS techniques: • TCC db • Ad hoc signing • Lazarus Group Mitre Heat Map • Recommendations for Defenders • Predictions • Q&A 2
  • 3. whoami Marina Liang • Independent Security Researcher - open to connecting ;) • 7 years in InfoSec with a focus on Windows + macOS • EDR vendors: Carbon Black, Crowdstrike • Background: Threat research, MDR, threat hunting, SecOps, EDR, purple teaming, IR, detection engineering • Active with Mitre ATT&CK community: • Windows Phantom DLL Hijacking - NEW • macOS TCC.db dumping (2) - NEW • Hobbies: Dance, yoga, art, travel, eating • LinkedIn: https://www.linkedin.com/in/marinaliang 3
  • 4. Overview of Lazarus Group Aka Labyrinth Chollima, HIDDEN COBRA, etc. • https://attack.mitre.org/groups/G0032/ • Origin: DPRK (Democratic People’s Republic of Korea) • Active since at least 2009 • Breaches: Sony, WannaCry, 3CX, JumpCloud • Targeted OS: Cross-platform - Windows, macOS, Linux, and…Cloud! • Motivation: Cyber espionage + currency generation • Targeted Verticals: Various, aerospace & defense, recent emphasis on FinTech (crypto) • Estimates of $2B in crypto-currency stolen • Targeted Geography: Various, South Korea, Europe, US 4
  • 5. LAZARUS GROUP: FORAY into macOS 5
  • 6. Evolution of Social Engineering Tactics Lazarus Group Demonstrates Targeted Social Engineering https://www.malwarebytes.com/blog/news/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/ 2019 - COVID Pandemic begin s • 2020- Targeted AstraZenec a • possibly to gain insights into COVID-19 for DPR K • Extortion or selling info for profit 2020-2021 - Targeting cyber security researcher s • Fake security compan y • Posed as security recruiters/ researchers 2021-2022 - Operation In(ter)ception • Decoy PDF lures for job vacancies at Coinbase and crypto.com • Cyber espionage + currency generation 2023: Continued job lure s • Recession themed? • Fake recruiter advertising jobs for a real or fake compan y • Sends them “interview questions” or “job description” to prep Social engineering themes change with existing geopolitical and socioeconomic time s Platforms: LinkedIn, Twitter, WhatsApp, Slack, Telegram, Discord, Keybase and email. 6 2019-2020 - Operation Dream Jo b • Targeted aerospace and defense, primarily in Eastern Europe • Cyber espionage
  • 7. Lazarus Tools If it ain’t broke, don’t fix it Notable Tool and Strategy Reuse : • Cryptocurrency trading program and fake crypto company + website hosting malwar e • AppleJeus (numerous iterations) - fake installer and macOS malware for cryptocurrency exchange • Persistence: Postinstall script installs malware as a launch daemon, extracting a hidden plist from the application’s /Resources directory. • Requires a single command-line argument in order to execute - likely to bypass ED R • Signed but not with a Apple developer ID https://objective-see.org/blog/blog_0x49.html 7
  • 8. Lazarus Tools: MATA & Masquerading Custom cross-platform remote access tool MATANet or MATA Framework or DACLS was a custom tool developed by Lazarus Group back around 2018. Though initially developed for other OS’s, Lazarus has since pivoted to macOS. • Various geographic targets: US, Poland, Germany, Turkey, Korea, Japan and India, and counting Masquerading MATA Framework implants and variants pose as common apps: • Adobe, Google Chrome, Oracle, fonts, Zoom, developer packages (fiddler, ruby gems), PyPi packages, etc. • macOS and Linux variants leverage plugins https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ 8
  • 9. Evolution of MATA: macOS Custom cross-platform remote access tool https://blogs.vmware.com/security/2022/11/threat-analysis-active-c2-discovery-using-protocol-emulation-part4-dacls-aka-mata.html https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ April 2018: MATA first seen in the wild - Windows and Linux - reported by 360 Netlab 2020-2022: VMware Threat Analysis Unit (TAU) scans the internet for MATA C2 servers, resulting in 121 active servers uncovered, with numbers declining. 2023: Developer package Masquerading: • Fake install.rb in /Library/Ruby/ Gems/ 2.6.0/extensions/ • Fake Bundler Ruby gem bundler.rb in / Library/Ruby/Gems/2.6.0/extensions/ • .rb files do not reside in / extensions/ 9 2020:First observed macOS variant on VT - Trojanized 2FA APP based on an open- source 2FA app, MinaOTP • Impersonating developer files “Contents/ Resources/Base.lproj/” • Fake SubMenu.nib (Mac executable file) Note: There are not a ton of MATA macOS samples out there, so happy to collaborate to augment this timeline.
  • 10. macOS RMM tools *macOS admins collectively cringe* JumpCloud supply chain attack 2023 - Targeted customers in the cryptocurrency industry - Lazarus Group uses JumpCloud to deploy ruby scripts and drop Mach-O executables and malware onto victim hosts - Access to existing infrastructure… Why use JumpCloud? - Permissions: Admin tools like Jamf and JumpCloud run with the required privileges to execute scripts and enumerate sensitive files - Easy to blend in - Noisy - difficult to tune out “what is normal” ⁃ https://www.mandiant.com/resources/blog/north-korea-supply-chain ⁃ https://jumpcloud.com/blog/security-update-june-20-incident-details-and-remediation 10
  • 12. Primer on TCC.db Transparency, Consent, Control (TCC) TCC framework: Security and privacy controls to prevent applications from being able to access sensitive data without user permission • Permissions include: full disk, camera, contacts and microphone acces s • If an application tries to access files protected by TCC without authorization, the operation is denied. Location: •global: (/Library/Application Support/com.apple.TCC/TCC.db) •user: ($HOME/Library/Application Support/com.apple.TCC/ TCC.db) •If you are an admin, if you grant yourself FDA, you grant all users (even non- admins) the ability to read all other users’ data on the disk, including your own . • As reported in CVE-2020-9771: A disk can be mounted and read by non- admin user s • If an actor copies malware over to the app bundle that already has TCC permissions with the right access, that app will execute 12 https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/
  • 13. TCC.db - what could go wrong? Lazarus Group dumps the TCC.db If an actor gains write access to the TCC.db, they could grant themselves TCC entitlements without alerting the user. System Integrity Protection (SIP) is supposed to mitigate this, BUT terminal could already have FDA enabled . Lazarus dumps the Transparency, Consent and Control (TCC) database . • The output of this dump would present a gold mine of possible applications to exploit: • What has FDA ? • What apps are allowed to access which service s • Any code-signing requirement data (csreq ) CMD: /bin/bash -c sqlite3 /Library/Application Support/com.apple.TCC/TCC.db '.dump access’ Some EDR/NGAV block this already, so Lazarus is likely to pivot … If Lazarus is blocked, it’s possible they could use SELECT instead of DUMP : •sudo sqlite3 /Library/Application Support/com.apple.TCC/TCC.db “SELECT client, allowed FROM access where service == ‘kTCCServiceSystemPolicyAllFiles’” | grep ‘1’$ 13
  • 14. Threat Hunting for TCC.db Mischief Experiment #1 with VT… • Query:(type:dmg or type:macho) and behavior:".dump access” - No hits :( • Query: behaviour_processes:”bash -c sqlite3” - Also no hits… :( :( • Cast a wide net: behaviour_processes:”TCC.db" - JACKPOT - 29 hits, approximately 40% confirmed malware
  • 15. Lazarus CloudMensis Campaign Threat Hunting for TCC.db Mischief
  • 16. Threat Hunting for TCC.db Mischief Bundlore copies the TCC.db too!
  • 17. Threat Hunting for TCC.db mischief Experiment #1 with VT… Takeaways from VT hunting • macOS malware authors including Lazarus have been exploiting the TCC.db for a couple of years (Bundlore, Cloudmensis, XCSSET malware) • Copying, dumping, writing to/inserting • Lazarus likely decoupling malware from commands to perform TCC.db operations (HOK, signature evasion) • Not many apps should be interacting with the TCC.db - detection opp!
  • 18. Adhoc Signing Signing without actual certificates ⁃ Intel and Apple silicon architectures handle code signing requirements differently ⁃ M1 Macs are the first apple computers restricted from running unsigned code “New in macOS 11 on Apple Silicon Mac computers, and starting in next macOS Big Sur 11 beta, the operating system will enforce that any executable must be signed with a valid signature before it’s allowed to run.” HOWEVER “There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long- established policy that our users and developers can run arbitrary code on their Macs, and is designed to simplify the execution policies on Apple silicon Mac computers and enable the system to better detect code modifications.” Additionally… “This new policy doesn’t apply to translated x86 binaries running under Rosetta, nor does it apply to macOS 11 running on Intel platforms” - Apple in WWDC 2020 https://developer.apple.com/documentation/security/seccodesignatureflags/1397793-adhoc https://wiki.lazarus.freepascal.org/Code_Signing_for_macOS https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/ 18
  • 19. Adhoc signing Bypassing Gatekeeper Lazarus has historically used unsigned or ad hoc signed binaries • Observed ad hoc signing via command line directly on the target host: CMD: codesign --force -s - [name of file or app] • A hyphen for the identity makes it an ad hoc signature with no certificate. Check the validity of an ad hoc signed executable with: CMD: codesign -dv -r- UpdateAgent 19
  • 20. Threat Hunting for adhoc signed files Experiment #2 with VT Some Mixed Takeaways: • VT search does not delineate ad hoc signed and only classifies as not signed • Lots of mach-O files are unsigned • Lots of crypto-related mach-O files are unsigned • Yara rule is probably better bet here
  • 21. Previously observed adhoc signed samples Operation In(ter)ception: These binaries are universal Mach-Os and can run on Intel or M1 Apple silicon machines. They are signed with an adhoc signature, meaning that they will bypass Apple’s Gatekeeper without a recognized developer identity. 21
  • 22. Recent adhoc Signed Malware: Rustbucket Multiple variants in 2023 - indicates continuous innovation • Malware written in Rust isn’t very commo n • In May 2023, a second RustBucket variant was observed targeting macOS users . • In June 2023, a third variant included new persistence capabilities. 22
  • 23. Mitre Mapping - Lazarus Group x macOS A synopsis of the TTPs covered today (in green) • Note1: TCC dumping and writing are not currently released (future ATT&CK version)! • Note2: Adhoc signing may arguably be a separate technique - new submission pending! 23
  • 24. Predictions for Lazarus They’re not going anywhere… •Lazarus will continue to evade analysis •Chunking malware into multiple stages •Leverage command line to evade file-based signatures • RUSTBUCKET malware will continue to evolve •Social engineering via LinkedIn will increase with likely recession in 2024 •Lazarus will continue their crypto and crypto-adjacent industry targeting (gaming) •Exploitation of commercial macOS admin tools will continue •Bypassing or disabling macOS security features will continue •Pay attention to WWDC 23, 24, 25, etc. • Lazarus will pivot if blocked from TCC.db dumping 24
  • 25. Recommendations for Blue Teamers Keep Calm and Enable Default macOS protections • Gatekeeper and SIP should be on by default for macOS. • Monitor for disabling of Gatekeeper and SIP, and implement automated re-enabling of these protections. • Security practitioners can automate via spctl and csrutil to re-enable Gatekeeper and SIP, respectively. • Pay special attention if you are in the crypto/crypto adjacent industry • Audit for shadow IT, especially unsanctioned macOS RMM tools • Baseline your environment • Deploy EDR everywhere • Least privilege always applies: Be judicious in what you grant permissions to. 25
  • 26. Special Thank You to: Couldn’t have done it without…. • The macOS cyber community <3 • Mitre for having me :) 26