InfoSecBulletin Cybersecurity for mankind
LockBit ransomware gang is reportedly developing a new version of malware that can encrypt files on Apple macOS, as revealed by MalwareHunterTeam. This would be the first instance of malware targeting Mac devices, as LockBit has previously focused on Linux and Windows devices.
The ransomware group is known for its RaaS (ransomware-as-a-service) operation, lending ransomware to cybercriminals for a fee. The new malware is named locker_Apple_M1_64, and there are separate versions for PowerPC Macs as well.
Hacker to exploite GeoServer Vulnerability to Deploy Malware
IMB unveils multiple vulnerabilities in it’s webMethods Integration
Progress LoadMaster exposed to a critical 10/10 vulnerability
Cisco released security updates for two critical security flaws
OpenBAS: Cutting-edge breach and attack simulation platform
Critical Security Flaws Patched in Zyxel Networking Devices
CVE-2024-38811: CEV In VMware Fusion Unveiled
CERT-IN Warns Vulnerabilities in Palo Alto Networks applications
How Malaysia’s Data Centre Industry Poised for Growth
RansomHub exfiltrated data over 210 victims: US alert
Malware Details:
The new malware, locker_Apple_M1_64, was first detected targeting Mac devices in November 2022, according to Vx-Underground, a platform that examines malware samples. It has not been detected by any anti-malware engines on VirusTotal, but information about this malware has been limited since last fall.
Researchers have noted that the LockBit ransomware gang is expanding its attack spectrum by targeting Macs, which marks a significant development in their tactics.
Expert Analysis:
According to Patrick Wardle, a security researcher and founder of Objective-See, while the malware is capable of running on Macs, it does not pose a serious risk due to several factors. The malware sample analyzed by Wardle was not signed by a trusted certificate, which means macOS won’t run it.
Additionally, Apple’s file system protection solutions such as Transparency, Consent, and Control/TCC would limit the impact of the malware even if it manages to infiltrate a macOS device. Moreover, the malware had bugs, and Wardle concluded that it was not ready for prime time.
In a blog post, Wardle stated that the ransomware is buggy and contains flaws, including buffer overflows that cause it to prematurely exit.
While this may be the first time a large ransomware group created ransomware capable of running on macOS, it is worth noting that this sample is far from ready for prime time […] From its lack of a valid code-signing signature to its ignorance of TCC and other macOS file-system protections as it stands it poses no threat to macOS users.
