SlideShare a Scribd company logo

Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS

M
MITRE ATT&CK

Marina Liang, a threat researcher, presents an in-depth analysis of the Lazarus Group's activities on macOS, focusing on their evolving social engineering tactics and malware techniques. Key findings include their utilization of TCC database manipulation, ad-hoc signing methods, and specific targeting strategies, with a notable emphasis on cyber espionage in the cryptocurrency sector. Recommendations for cybersecurity practitioners include enabling macOS protections and closely monitoring for security breaches, especially in the crypto industry.

Technology
1 of 26
Downloaded 53 times
1
2
3
4
5
6
Most read
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Most read
25
26
Most read
Marina Liang, Threat Researcher Exploring the Labyrinth Deep dive into the Lazarus Group’s foray into macOS 1
Agenda Follow me down the labyrinth… • Whoami • Overview of Lazarus Group • Foray into macOS • New(ish) macOS techniques: • TCC db • Ad hoc signing • Lazarus Group Mitre Heat Map • Recommendations for Defenders • Predictions • Q&A 2
whoami Marina Liang • Independent Security Researcher - open to connecting ;) • 7 years in InfoSec with a focus on Windows + macOS • EDR vendors: Carbon Black, Crowdstrike • Background: Threat research, MDR, threat hunting, SecOps, EDR, purple teaming, IR, detection engineering • Active with Mitre ATT&CK community: • Windows Phantom DLL Hijacking - NEW • macOS TCC.db dumping (2) - NEW • Hobbies: Dance, yoga, art, travel, eating • LinkedIn: https://www.linkedin.com/in/marinaliang 3
Overview of Lazarus Group Aka Labyrinth Chollima, HIDDEN COBRA, etc. • https://attack.mitre.org/groups/G0032/ • Origin: DPRK (Democratic People’s Republic of Korea) • Active since at least 2009 • Breaches: Sony, WannaCry, 3CX, JumpCloud • Targeted OS: Cross-platform - Windows, macOS, Linux, and…Cloud! • Motivation: Cyber espionage + currency generation • Targeted Verticals: Various, aerospace & defense, recent emphasis on FinTech (crypto) • Estimates of $2B in crypto-currency stolen • Targeted Geography: Various, South Korea, Europe, US 4
LAZARUS GROUP: FORAY into macOS 5
Evolution of Social Engineering Tactics Lazarus Group Demonstrates Targeted Social Engineering https://www.malwarebytes.com/blog/news/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/ 2019 - COVID Pandemic begin s • 2020- Targeted AstraZenec a • possibly to gain insights into COVID-19 for DPR K • Extortion or selling info for profit 2020-2021 - Targeting cyber security researcher s • Fake security compan y • Posed as security recruiters/ researchers 2021-2022 - Operation In(ter)ception • Decoy PDF lures for job vacancies at Coinbase and crypto.com • Cyber espionage + currency generation 2023: Continued job lure s • Recession themed? • Fake recruiter advertising jobs for a real or fake compan y • Sends them “interview questions” or “job description” to prep Social engineering themes change with existing geopolitical and socioeconomic time s Platforms: LinkedIn, Twitter, WhatsApp, Slack, Telegram, Discord, Keybase and email. 6 2019-2020 - Operation Dream Jo b • Targeted aerospace and defense, primarily in Eastern Europe • Cyber espionage
Lazarus Tools If it ain’t broke, don’t fix it Notable Tool and Strategy Reuse : • Cryptocurrency trading program and fake crypto company + website hosting malwar e • AppleJeus (numerous iterations) - fake installer and macOS malware for cryptocurrency exchange • Persistence: Postinstall script installs malware as a launch daemon, extracting a hidden plist from the application’s /Resources directory. • Requires a single command-line argument in order to execute - likely to bypass ED R • Signed but not with a Apple developer ID https://objective-see.org/blog/blog_0x49.html 7
Lazarus Tools: MATA & Masquerading Custom cross-platform remote access tool MATANet or MATA Framework or DACLS was a custom tool developed by Lazarus Group back around 2018. Though initially developed for other OS’s, Lazarus has since pivoted to macOS. • Various geographic targets: US, Poland, Germany, Turkey, Korea, Japan and India, and counting Masquerading MATA Framework implants and variants pose as common apps: • Adobe, Google Chrome, Oracle, fonts, Zoom, developer packages (fiddler, ruby gems), PyPi packages, etc. • macOS and Linux variants leverage plugins https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ 8
Evolution of MATA: macOS Custom cross-platform remote access tool https://blogs.vmware.com/security/2022/11/threat-analysis-active-c2-discovery-using-protocol-emulation-part4-dacls-aka-mata.html https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ April 2018: MATA first seen in the wild - Windows and Linux - reported by 360 Netlab 2020-2022: VMware Threat Analysis Unit (TAU) scans the internet for MATA C2 servers, resulting in 121 active servers uncovered, with numbers declining. 2023: Developer package Masquerading: • Fake install.rb in /Library/Ruby/ Gems/ 2.6.0/extensions/ • Fake Bundler Ruby gem bundler.rb in / Library/Ruby/Gems/2.6.0/extensions/ • .rb files do not reside in / extensions/ 9 2020:First observed macOS variant on VT - Trojanized 2FA APP based on an open- source 2FA app, MinaOTP • Impersonating developer files “Contents/ Resources/Base.lproj/” • Fake SubMenu.nib (Mac executable file) Note: There are not a ton of MATA macOS samples out there, so happy to collaborate to augment this timeline.
macOS RMM tools *macOS admins collectively cringe* JumpCloud supply chain attack 2023 - Targeted customers in the cryptocurrency industry - Lazarus Group uses JumpCloud to deploy ruby scripts and drop Mach-O executables and malware onto victim hosts - Access to existing infrastructure… Why use JumpCloud? - Permissions: Admin tools like Jamf and JumpCloud run with the required privileges to execute scripts and enumerate sensitive files - Easy to blend in - Noisy - difficult to tune out “what is normal” ⁃ https://www.mandiant.com/resources/blog/north-korea-supply-chain ⁃ https://jumpcloud.com/blog/security-update-june-20-incident-details-and-remediation 10
LAZARUS GROUP: RECENT TTPs 11
Primer on TCC.db Transparency, Consent, Control (TCC) TCC framework: Security and privacy controls to prevent applications from being able to access sensitive data without user permission • Permissions include: full disk, camera, contacts and microphone acces s • If an application tries to access files protected by TCC without authorization, the operation is denied. Location: •global: (/Library/Application Support/com.apple.TCC/TCC.db) •user: ($HOME/Library/Application Support/com.apple.TCC/ TCC.db) •If you are an admin, if you grant yourself FDA, you grant all users (even non- admins) the ability to read all other users’ data on the disk, including your own . • As reported in CVE-2020-9771: A disk can be mounted and read by non- admin user s • If an actor copies malware over to the app bundle that already has TCC permissions with the right access, that app will execute 12 https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/
TCC.db - what could go wrong? Lazarus Group dumps the TCC.db If an actor gains write access to the TCC.db, they could grant themselves TCC entitlements without alerting the user. System Integrity Protection (SIP) is supposed to mitigate this, BUT terminal could already have FDA enabled . Lazarus dumps the Transparency, Consent and Control (TCC) database . • The output of this dump would present a gold mine of possible applications to exploit: • What has FDA ? • What apps are allowed to access which service s • Any code-signing requirement data (csreq ) CMD: /bin/bash -c sqlite3 /Library/Application Support/com.apple.TCC/TCC.db '.dump access’ Some EDR/NGAV block this already, so Lazarus is likely to pivot … If Lazarus is blocked, it’s possible they could use SELECT instead of DUMP : •sudo sqlite3 /Library/Application Support/com.apple.TCC/TCC.db “SELECT client, allowed FROM access where service == ‘kTCCServiceSystemPolicyAllFiles’” | grep ‘1’$ 13
Threat Hunting for TCC.db Mischief Experiment #1 with VT… • Query:(type:dmg or type:macho) and behavior:".dump access” - No hits :( • Query: behaviour_processes:”bash -c sqlite3” - Also no hits… :( :( • Cast a wide net: behaviour_processes:”TCC.db" - JACKPOT - 29 hits, approximately 40% confirmed malware
Lazarus CloudMensis Campaign Threat Hunting for TCC.db Mischief
Threat Hunting for TCC.db Mischief Bundlore copies the TCC.db too!
Threat Hunting for TCC.db mischief Experiment #1 with VT… Takeaways from VT hunting • macOS malware authors including Lazarus have been exploiting the TCC.db for a couple of years (Bundlore, Cloudmensis, XCSSET malware) • Copying, dumping, writing to/inserting • Lazarus likely decoupling malware from commands to perform TCC.db operations (HOK, signature evasion) • Not many apps should be interacting with the TCC.db - detection opp!
Adhoc Signing Signing without actual certificates ⁃ Intel and Apple silicon architectures handle code signing requirements differently ⁃ M1 Macs are the first apple computers restricted from running unsigned code “New in macOS 11 on Apple Silicon Mac computers, and starting in next macOS Big Sur 11 beta, the operating system will enforce that any executable must be signed with a valid signature before it’s allowed to run.” HOWEVER “There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long- established policy that our users and developers can run arbitrary code on their Macs, and is designed to simplify the execution policies on Apple silicon Mac computers and enable the system to better detect code modifications.” Additionally… “This new policy doesn’t apply to translated x86 binaries running under Rosetta, nor does it apply to macOS 11 running on Intel platforms” - Apple in WWDC 2020 https://developer.apple.com/documentation/security/seccodesignatureflags/1397793-adhoc https://wiki.lazarus.freepascal.org/Code_Signing_for_macOS https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/ 18
Adhoc signing Bypassing Gatekeeper Lazarus has historically used unsigned or ad hoc signed binaries • Observed ad hoc signing via command line directly on the target host: CMD: codesign --force -s - [name of file or app] • A hyphen for the identity makes it an ad hoc signature with no certificate. Check the validity of an ad hoc signed executable with: CMD: codesign -dv -r- UpdateAgent 19
Threat Hunting for adhoc signed files Experiment #2 with VT Some Mixed Takeaways: • VT search does not delineate ad hoc signed and only classifies as not signed • Lots of mach-O files are unsigned • Lots of crypto-related mach-O files are unsigned • Yara rule is probably better bet here
Previously observed adhoc signed samples Operation In(ter)ception: These binaries are universal Mach-Os and can run on Intel or M1 Apple silicon machines. They are signed with an adhoc signature, meaning that they will bypass Apple’s Gatekeeper without a recognized developer identity. 21
Recent adhoc Signed Malware: Rustbucket Multiple variants in 2023 - indicates continuous innovation • Malware written in Rust isn’t very commo n • In May 2023, a second RustBucket variant was observed targeting macOS users . • In June 2023, a third variant included new persistence capabilities. 22
Mitre Mapping - Lazarus Group x macOS A synopsis of the TTPs covered today (in green) • Note1: TCC dumping and writing are not currently released (future ATT&CK version)! • Note2: Adhoc signing may arguably be a separate technique - new submission pending! 23
Predictions for Lazarus They’re not going anywhere… •Lazarus will continue to evade analysis •Chunking malware into multiple stages •Leverage command line to evade file-based signatures • RUSTBUCKET malware will continue to evolve •Social engineering via LinkedIn will increase with likely recession in 2024 •Lazarus will continue their crypto and crypto-adjacent industry targeting (gaming) •Exploitation of commercial macOS admin tools will continue •Bypassing or disabling macOS security features will continue •Pay attention to WWDC 23, 24, 25, etc. • Lazarus will pivot if blocked from TCC.db dumping 24
Recommendations for Blue Teamers Keep Calm and Enable Default macOS protections • Gatekeeper and SIP should be on by default for macOS. • Monitor for disabling of Gatekeeper and SIP, and implement automated re-enabling of these protections. • Security practitioners can automate via spctl and csrutil to re-enable Gatekeeper and SIP, respectively. • Pay special attention if you are in the crypto/crypto adjacent industry • Audit for shadow IT, especially unsanctioned macOS RMM tools • Baseline your environment • Deploy EDR everywhere • Least privilege always applies: Be judicious in what you grant permissions to. 25
Special Thank You to: Couldn’t have done it without…. • The macOS cyber community <3 • Mitre for having me :) 26

More Related Content

PDF
.LNK Tears of the Kingdom
MITRE ATT&CK
 
PDF
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
MITRE ATT&CK
 
PDF
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
MITRE ATT&CK
 
PDF
Cloud Native Workload ATT&CK Matrix
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK
 
PDF
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
MITRE ATT&CK
 
PDF
MITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK
 
PDF
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
MITRE ATT&CK
 
.LNK Tears of the Kingdom
MITRE ATT&CK
 
Evaluating and Enhancing Security Maturity through MITRE ATT&CK Mapping
MITRE ATT&CK
 
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...
MITRE ATT&CK
 
Cloud Native Workload ATT&CK Matrix
MITRE ATT&CK
 
MITRE ATT&CK Updates: State of the ATT&CK (ATT&CKcon 4.0 Edition)
MITRE ATT&CK
 
One Leg to Stand on: Adventures in Adversary Tracking with ATT&CK
MITRE ATT&CK
 
MITRE ATT&CK based Threat Analysis for Electronic Flight Bag
MITRE ATT&CK
 
Civil Society, Pegasus, and Predator: What Sophisticated Spyware Means For Us...
MITRE ATT&CK
 

What's hot (20)

PDF
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
MITRE ATT&CK
 
PDF
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: ICS
MITRE ATT&CK
 
PDF
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
MITRE ATT&CK
 
PDF
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
MITRE ATT&CK
 
PDF
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
MITRE ATT&CK
 
PDF
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
MITRE ATT&CK
 
PDF
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
PDF
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
PDF
CISA usage of ATT&CK in Cybersecurity Advisories
MITRE ATT&CK
 
PDF
Introduction to red team operations
Sunny Neo
 
PDF
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
PDF
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
PDF
MITRE ATT&CK Framework
n|u - The Open Security Community
 
PDF
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
PDF
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
PDF
ATT&CKcon Intro
MITRE ATT&CK
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
PDF
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
Grow Up! Evaluating and Maturing Your SOC using MITRE ATT&CK
MITRE ATT&CK
 
ATT&CK Metaverse - Exploring the Limitations of Applying ATT&CK
MITRE ATT&CK
 
MITRE ATT&CK Updates: ICS
MITRE ATT&CK
 
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...
MITRE ATT&CK
 
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR Telemetry
MITRE ATT&CK
 
ATT&CK is the Best Defense - Emulating Sophisticated Adversary Malware to Bol...
MITRE ATT&CK
 
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...
MITRE ATT&CK
 
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK for mac/Linux
MITRE ATT&CK
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
CISA usage of ATT&CK in Cybersecurity Advisories
MITRE ATT&CK
 
Introduction to red team operations
Sunny Neo
 
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Mapping ATT&CK Techniques to ENGAGE Activities
MITRE ATT&CK
 
MITRE ATT&CK Framework
n|u - The Open Security Community
 
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
MITRE ATT&CK
 
ATT&CKcon Intro
MITRE ATT&CK
 
PHDays 2018 Threat Hunting Hands-On Lab
Teymur Kheirkhabarov
 
Threat Modelling - It's not just for developers
MITRE ATT&CK
 
Ad

Similar to Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS (20)

PDF
0-Day Up Your Sleeve - Attacking macOS Environments
SecuRing
 
PDF
Security on the Mac
Allison Sheridan
 
PDF
OS X Malware: Let's Play Doctor
Synack
 
PDF
OSX Pirrit : Why you should care about malicious mac adware
Priyanka Aash
 
PDF
DEF CON 27 - workshop - RICHARD GOLD - mind the gap
Felipe Prado
 
PDF
macOS Vulnerabilities Hiding in Plain Sight
Csaba Fitzl
 
PDF
The Final Chapter - Unlimited Ways to Bypass Your macOS Privacy Mechanisms
Csaba Fitzl
 
PDF
RSA OSX Malware
Synack
 
PPTX
OSX/Pirrit: The blue balls of OS X adware
Amit Serper
 
PDF
Steve brueckner-atc-ny
jcaire
 
PDF
What happens on your Mac, stays on Apple’s iCloud?!
SecuRing
 
PDF
20+ ways to bypass your mac os privacy mechanisms
Csaba Fitzl
 
PDF
Hacking Exposed: The Mac Attack
Priyanka Aash
 
PDF
Hacking Exposed: The Mac Attack
Priyanka Aash
 
PDF
Exploiting Directory Permissions on macOS
Csaba Fitzl
 
PDF
MACTANS: Injecting Malware
into iOS Devices via Malicious Chargers
Joon Young Park
 
PPT
Safe Computing At Home And Work
John Steensen, MBA/TM, CISA, CRISC
 
PDF
20+ Ways to Bypass Your macOS Privacy Mechanisms
SecuRing
 
PDF
I can be apple and so can you
Shakacon
 
PDF
CSI - Poor Mans Guide To Espionage Gear
shawn_merdinger
 
0-Day Up Your Sleeve - Attacking macOS Environments
SecuRing
 
Security on the Mac
Allison Sheridan
 
OS X Malware: Let's Play Doctor
Synack
 
OSX Pirrit : Why you should care about malicious mac adware
Priyanka Aash
 
DEF CON 27 - workshop - RICHARD GOLD - mind the gap
Felipe Prado
 
macOS Vulnerabilities Hiding in Plain Sight
Csaba Fitzl
 
The Final Chapter - Unlimited Ways to Bypass Your macOS Privacy Mechanisms
Csaba Fitzl
 
RSA OSX Malware
Synack
 
OSX/Pirrit: The blue balls of OS X adware
Amit Serper
 
Steve brueckner-atc-ny
jcaire
 
What happens on your Mac, stays on Apple’s iCloud?!
SecuRing
 
20+ ways to bypass your mac os privacy mechanisms
Csaba Fitzl
 
Hacking Exposed: The Mac Attack
Priyanka Aash
 
Hacking Exposed: The Mac Attack
Priyanka Aash
 
Exploiting Directory Permissions on macOS
Csaba Fitzl
 
MACTANS: Injecting Malware
into iOS Devices via Malicious Chargers
Joon Young Park
 
Safe Computing At Home And Work
John Steensen, MBA/TM, CISA, CRISC
 
20+ Ways to Bypass Your macOS Privacy Mechanisms
SecuRing
 
I can be apple and so can you
Shakacon
 
CSI - Poor Mans Guide To Espionage Gear
shawn_merdinger
 
Ad

More from MITRE ATT&CK (20)

PDF
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
PDF
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
PDF
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
PDF
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
PDF
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
PDF
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
PDF
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
PDF
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
PDF
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
PDF
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
PDF
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
PDF
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
PDF
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
PDF
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
PDF
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
PDF
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 
Next-Gen Threat-Informed Defense: Human-Assisted Intelligent Agents - Rajesh ...
MITRE ATT&CK
 
Birds of a Feather: The Evolution of Threat Actor Prioritization, Gap Analysi...
MITRE ATT&CK
 
Using ATT&CK and MITRE CTID’s StP Frameworks to Assess Threat Detection Resil...
MITRE ATT&CK
 
Bridging the Gap: Enhancing Detection Coverage with Atomic Red Team, Sigma, a...
MITRE ATT&CK
 
SaaSy ATT&CK – Practical ATT&CK usage for SaaS-based Telemetry - Aaron Shelmire
MITRE ATT&CK
 
I'll take ATT&CK techniques that can be done for $1000, Alex. - Ben Langrill
MITRE ATT&CK
 
Practical Application of MITRE ATT&CK: Real World Usage in a Corporate Enviro...
MITRE ATT&CK
 
This is why we don’t shout “Bingo”: Analyzing ATT&CK Integration in Endpoint ...
MITRE ATT&CK
 
Every Cloud Has a Purple Lining - Arun Seelagan
MITRE ATT&CK
 
Confession: 3 Things I Wish I Knew About MITRE ATT&CK When I Was an FBI Profi...
MITRE ATT&CK
 
ATT&CKcon 5.0 Keynote - From Ticket Closers to Practitioners- How Great Secu...
MITRE ATT&CK
 
ATT&CKcon 5.0 Lightning Talks - Various Speakers
MITRE ATT&CK
 
MITRE ATT&CK Updates: Defensive ATT&CK - Lex Crumpton
MITRE ATT&CK
 
MITRE ATT&CK Updates: Enterprise - Casey Knerr
MITRE ATT&CK
 
MITRE ATT&CK Updates: CTI - Path Forward - Joe Slowik
MITRE ATT&CK
 
MITRE ATT&CK Updates: Software - Jared Ondricek
MITRE ATT&CK
 
State of the ATT&CK 2024 - Adam Pennington
MITRE ATT&CK
 
Sources of ATT&CK: A Bibliographic Journey through Enterprise ATT&CK - Robert...
MITRE ATT&CK
 
Updates from The Center for Threat Informed Defense - Jon Baker
MITRE ATT&CK
 
Go Go Ransom Rangers: Diving into Akira’s Linux Variant with ATT&CK - Nicole ...
MITRE ATT&CK
 

Recently uploaded (20)

PPTX
Spectroscopy.pptx food analysis technology
nawahassan45
 
PDF
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PDF
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
PDF
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
PDF
Approach and Philosophy of On baking technology
30anthuong17
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
Spectroscopy.pptx food analysis technology
nawahassan45
 
TokAI - TikTok AI Agent : The First AI Application That Analyzes 10,000+ Vira...
SOFTTECHHUB
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
cuic standard and advanced reporting.pdf
SimoneTitaniumTomase
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
Spectral efficient network and resource selection model in 5G networks
IAESIJAI
 
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
Reach Out and Touch Someone: Haptics and Empathic Computing
Mark Billinghurst
 
Approach and Philosophy of On baking technology
30anthuong17
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
MYSQL Presentation for SQL database connectivity
Swati270511
 

Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOS

  • 1. Marina Liang, Threat Researcher Exploring the Labyrinth Deep dive into the Lazarus Group’s foray into macOS 1
  • 2. Agenda Follow me down the labyrinth… • Whoami • Overview of Lazarus Group • Foray into macOS • New(ish) macOS techniques: • TCC db • Ad hoc signing • Lazarus Group Mitre Heat Map • Recommendations for Defenders • Predictions • Q&A 2
  • 3. whoami Marina Liang • Independent Security Researcher - open to connecting ;) • 7 years in InfoSec with a focus on Windows + macOS • EDR vendors: Carbon Black, Crowdstrike • Background: Threat research, MDR, threat hunting, SecOps, EDR, purple teaming, IR, detection engineering • Active with Mitre ATT&CK community: • Windows Phantom DLL Hijacking - NEW • macOS TCC.db dumping (2) - NEW • Hobbies: Dance, yoga, art, travel, eating • LinkedIn: https://www.linkedin.com/in/marinaliang 3
  • 4. Overview of Lazarus Group Aka Labyrinth Chollima, HIDDEN COBRA, etc. • https://attack.mitre.org/groups/G0032/ • Origin: DPRK (Democratic People’s Republic of Korea) • Active since at least 2009 • Breaches: Sony, WannaCry, 3CX, JumpCloud • Targeted OS: Cross-platform - Windows, macOS, Linux, and…Cloud! • Motivation: Cyber espionage + currency generation • Targeted Verticals: Various, aerospace & defense, recent emphasis on FinTech (crypto) • Estimates of $2B in crypto-currency stolen • Targeted Geography: Various, South Korea, Europe, US 4
  • 5. LAZARUS GROUP: FORAY into macOS 5
  • 6. Evolution of Social Engineering Tactics Lazarus Group Demonstrates Targeted Social Engineering https://www.malwarebytes.com/blog/news/2020/05/new-mac-variant-of-lazarus-dacls-rat-distributed-via-trojanized-2fa-app https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://www.sentinelone.com/blog/lazarus-operation-interception-targets-macos-users-dreaming-of-jobs-in-crypto/ 2019 - COVID Pandemic begin s • 2020- Targeted AstraZenec a • possibly to gain insights into COVID-19 for DPR K • Extortion or selling info for profit 2020-2021 - Targeting cyber security researcher s • Fake security compan y • Posed as security recruiters/ researchers 2021-2022 - Operation In(ter)ception • Decoy PDF lures for job vacancies at Coinbase and crypto.com • Cyber espionage + currency generation 2023: Continued job lure s • Recession themed? • Fake recruiter advertising jobs for a real or fake compan y • Sends them “interview questions” or “job description” to prep Social engineering themes change with existing geopolitical and socioeconomic time s Platforms: LinkedIn, Twitter, WhatsApp, Slack, Telegram, Discord, Keybase and email. 6 2019-2020 - Operation Dream Jo b • Targeted aerospace and defense, primarily in Eastern Europe • Cyber espionage
  • 7. Lazarus Tools If it ain’t broke, don’t fix it Notable Tool and Strategy Reuse : • Cryptocurrency trading program and fake crypto company + website hosting malwar e • AppleJeus (numerous iterations) - fake installer and macOS malware for cryptocurrency exchange • Persistence: Postinstall script installs malware as a launch daemon, extracting a hidden plist from the application’s /Resources directory. • Requires a single command-line argument in order to execute - likely to bypass ED R • Signed but not with a Apple developer ID https://objective-see.org/blog/blog_0x49.html 7
  • 8. Lazarus Tools: MATA & Masquerading Custom cross-platform remote access tool MATANet or MATA Framework or DACLS was a custom tool developed by Lazarus Group back around 2018. Though initially developed for other OS’s, Lazarus has since pivoted to macOS. • Various geographic targets: US, Poland, Germany, Turkey, Korea, Japan and India, and counting Masquerading MATA Framework implants and variants pose as common apps: • Adobe, Google Chrome, Oracle, fonts, Zoom, developer packages (fiddler, ruby gems), PyPi packages, etc. • macOS and Linux variants leverage plugins https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ 8
  • 9. Evolution of MATA: macOS Custom cross-platform remote access tool https://blogs.vmware.com/security/2022/11/threat-analysis-active-c2-discovery-using-protocol-emulation-part4-dacls-aka-mata.html https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/ April 2018: MATA first seen in the wild - Windows and Linux - reported by 360 Netlab 2020-2022: VMware Threat Analysis Unit (TAU) scans the internet for MATA C2 servers, resulting in 121 active servers uncovered, with numbers declining. 2023: Developer package Masquerading: • Fake install.rb in /Library/Ruby/ Gems/ 2.6.0/extensions/ • Fake Bundler Ruby gem bundler.rb in / Library/Ruby/Gems/2.6.0/extensions/ • .rb files do not reside in / extensions/ 9 2020:First observed macOS variant on VT - Trojanized 2FA APP based on an open- source 2FA app, MinaOTP • Impersonating developer files “Contents/ Resources/Base.lproj/” • Fake SubMenu.nib (Mac executable file) Note: There are not a ton of MATA macOS samples out there, so happy to collaborate to augment this timeline.
  • 10. macOS RMM tools *macOS admins collectively cringe* JumpCloud supply chain attack 2023 - Targeted customers in the cryptocurrency industry - Lazarus Group uses JumpCloud to deploy ruby scripts and drop Mach-O executables and malware onto victim hosts - Access to existing infrastructure… Why use JumpCloud? - Permissions: Admin tools like Jamf and JumpCloud run with the required privileges to execute scripts and enumerate sensitive files - Easy to blend in - Noisy - difficult to tune out “what is normal” ⁃ https://www.mandiant.com/resources/blog/north-korea-supply-chain ⁃ https://jumpcloud.com/blog/security-update-june-20-incident-details-and-remediation 10
  • 12. Primer on TCC.db Transparency, Consent, Control (TCC) TCC framework: Security and privacy controls to prevent applications from being able to access sensitive data without user permission • Permissions include: full disk, camera, contacts and microphone acces s • If an application tries to access files protected by TCC without authorization, the operation is denied. Location: •global: (/Library/Application Support/com.apple.TCC/TCC.db) •user: ($HOME/Library/Application Support/com.apple.TCC/ TCC.db) •If you are an admin, if you grant yourself FDA, you grant all users (even non- admins) the ability to read all other users’ data on the disk, including your own . • As reported in CVE-2020-9771: A disk can be mounted and read by non- admin user s • If an actor copies malware over to the app bundle that already has TCC permissions with the right access, that app will execute 12 https://www.sentinelone.com/labs/bypassing-macos-tcc-user-privacy-protections-by-accident-and-design/
  • 13. TCC.db - what could go wrong? Lazarus Group dumps the TCC.db If an actor gains write access to the TCC.db, they could grant themselves TCC entitlements without alerting the user. System Integrity Protection (SIP) is supposed to mitigate this, BUT terminal could already have FDA enabled . Lazarus dumps the Transparency, Consent and Control (TCC) database . • The output of this dump would present a gold mine of possible applications to exploit: • What has FDA ? • What apps are allowed to access which service s • Any code-signing requirement data (csreq ) CMD: /bin/bash -c sqlite3 /Library/Application Support/com.apple.TCC/TCC.db '.dump access’ Some EDR/NGAV block this already, so Lazarus is likely to pivot … If Lazarus is blocked, it’s possible they could use SELECT instead of DUMP : •sudo sqlite3 /Library/Application Support/com.apple.TCC/TCC.db “SELECT client, allowed FROM access where service == ‘kTCCServiceSystemPolicyAllFiles’” | grep ‘1’$ 13
  • 14. Threat Hunting for TCC.db Mischief Experiment #1 with VT… • Query:(type:dmg or type:macho) and behavior:".dump access” - No hits :( • Query: behaviour_processes:”bash -c sqlite3” - Also no hits… :( :( • Cast a wide net: behaviour_processes:”TCC.db" - JACKPOT - 29 hits, approximately 40% confirmed malware
  • 15. Lazarus CloudMensis Campaign Threat Hunting for TCC.db Mischief
  • 16. Threat Hunting for TCC.db Mischief Bundlore copies the TCC.db too!
  • 17. Threat Hunting for TCC.db mischief Experiment #1 with VT… Takeaways from VT hunting • macOS malware authors including Lazarus have been exploiting the TCC.db for a couple of years (Bundlore, Cloudmensis, XCSSET malware) • Copying, dumping, writing to/inserting • Lazarus likely decoupling malware from commands to perform TCC.db operations (HOK, signature evasion) • Not many apps should be interacting with the TCC.db - detection opp!
  • 18. Adhoc Signing Signing without actual certificates ⁃ Intel and Apple silicon architectures handle code signing requirements differently ⁃ M1 Macs are the first apple computers restricted from running unsigned code “New in macOS 11 on Apple Silicon Mac computers, and starting in next macOS Big Sur 11 beta, the operating system will enforce that any executable must be signed with a valid signature before it’s allowed to run.” HOWEVER “There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long- established policy that our users and developers can run arbitrary code on their Macs, and is designed to simplify the execution policies on Apple silicon Mac computers and enable the system to better detect code modifications.” Additionally… “This new policy doesn’t apply to translated x86 binaries running under Rosetta, nor does it apply to macOS 11 running on Intel platforms” - Apple in WWDC 2020 https://developer.apple.com/documentation/security/seccodesignatureflags/1397793-adhoc https://wiki.lazarus.freepascal.org/Code_Signing_for_macOS https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-require-signed-code/ 18
  • 19. Adhoc signing Bypassing Gatekeeper Lazarus has historically used unsigned or ad hoc signed binaries • Observed ad hoc signing via command line directly on the target host: CMD: codesign --force -s - [name of file or app] • A hyphen for the identity makes it an ad hoc signature with no certificate. Check the validity of an ad hoc signed executable with: CMD: codesign -dv -r- UpdateAgent 19
  • 20. Threat Hunting for adhoc signed files Experiment #2 with VT Some Mixed Takeaways: • VT search does not delineate ad hoc signed and only classifies as not signed • Lots of mach-O files are unsigned • Lots of crypto-related mach-O files are unsigned • Yara rule is probably better bet here
  • 21. Previously observed adhoc signed samples Operation In(ter)ception: These binaries are universal Mach-Os and can run on Intel or M1 Apple silicon machines. They are signed with an adhoc signature, meaning that they will bypass Apple’s Gatekeeper without a recognized developer identity. 21
  • 22. Recent adhoc Signed Malware: Rustbucket Multiple variants in 2023 - indicates continuous innovation • Malware written in Rust isn’t very commo n • In May 2023, a second RustBucket variant was observed targeting macOS users . • In June 2023, a third variant included new persistence capabilities. 22
  • 23. Mitre Mapping - Lazarus Group x macOS A synopsis of the TTPs covered today (in green) • Note1: TCC dumping and writing are not currently released (future ATT&CK version)! • Note2: Adhoc signing may arguably be a separate technique - new submission pending! 23
  • 24. Predictions for Lazarus They’re not going anywhere… •Lazarus will continue to evade analysis •Chunking malware into multiple stages •Leverage command line to evade file-based signatures • RUSTBUCKET malware will continue to evolve •Social engineering via LinkedIn will increase with likely recession in 2024 •Lazarus will continue their crypto and crypto-adjacent industry targeting (gaming) •Exploitation of commercial macOS admin tools will continue •Bypassing or disabling macOS security features will continue •Pay attention to WWDC 23, 24, 25, etc. • Lazarus will pivot if blocked from TCC.db dumping 24
  • 25. Recommendations for Blue Teamers Keep Calm and Enable Default macOS protections • Gatekeeper and SIP should be on by default for macOS. • Monitor for disabling of Gatekeeper and SIP, and implement automated re-enabling of these protections. • Security practitioners can automate via spctl and csrutil to re-enable Gatekeeper and SIP, respectively. • Pay special attention if you are in the crypto/crypto adjacent industry • Audit for shadow IT, especially unsanctioned macOS RMM tools • Baseline your environment • Deploy EDR everywhere • Least privilege always applies: Be judicious in what you grant permissions to. 25
  • 26. Special Thank You to: Couldn’t have done it without…. • The macOS cyber community <3 • Mitre for having me :) 26