InfoSecBulletin Cybersecurity for mankind
LockBit ransomware gang is reportedly developing a new version of malware that can encrypt files on Apple macOS, as revealed by MalwareHunterTeam. This would be the first instance of malware targeting Mac devices, as LockBit has previously focused on Linux and Windows devices.
The ransomware group is known for its RaaS (ransomware-as-a-service) operation, lending ransomware to cybercriminals for a fee. The new malware is named locker_Apple_M1_64, and there are separate versions for PowerPC Macs as well.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Malware Details:
The new malware, locker_Apple_M1_64, was first detected targeting Mac devices in November 2022, according to Vx-Underground, a platform that examines malware samples. It has not been detected by any anti-malware engines on VirusTotal, but information about this malware has been limited since last fall.
Researchers have noted that the LockBit ransomware gang is expanding its attack spectrum by targeting Macs, which marks a significant development in their tactics.
Expert Analysis:
According to Patrick Wardle, a security researcher and founder of Objective-See, while the malware is capable of running on Macs, it does not pose a serious risk due to several factors. The malware sample analyzed by Wardle was not signed by a trusted certificate, which means macOS won’t run it.
Additionally, Apple’s file system protection solutions such as Transparency, Consent, and Control/TCC would limit the impact of the malware even if it manages to infiltrate a macOS device. Moreover, the malware had bugs, and Wardle concluded that it was not ready for prime time.
In a blog post, Wardle stated that the ransomware is buggy and contains flaws, including buffer overflows that cause it to prematurely exit.
While this may be the first time a large ransomware group created ransomware capable of running on macOS, it is worth noting that this sample is far from ready for prime time […] From its lack of a valid code-signing signature to its ignorance of TCC and other macOS file-system protections as it stands it poses no threat to macOS users.
