Earlier this month Sixgill, a cyber intelligence company provided information on a recently discovered trojan for Apple macOS systems. It is being sold on the underground Russian cybercrime forums and acts as a remote administration tool (RAT)(defined). It sells under the name of Proton for 100 Bitcoin (more than USD$100,000) but now allows unlimited installations for 40 Bitcoin or a single installation for 2 Bitcoin.
Since the trojan is a RAT (discussed above) it allows an attacker to have full control of a victim’s system which includes controlling file uploads and downloads, monitoring keyboard presses, taking screenshots and webcam surveillance.
Sixgill theorizes the trojans developers bypassed/worked around Apple’s Developer ID program allowing this “application” to appear harmless while possibly exploiting an unknown zero day vulnerability (defined) within macOS to root privileges (defined) over the victim system.
How can I protect myself from this malware?
Since the trojan allows full control of an over an infected system, this will complicate removal since the attackers could easily attempt to resist or undo removal actions. Malwarebytes state this trojan is not in widespread use and they have been unable so far to obtain a sample of it. Moreover, VirusTotal did not have a sample to provide to them.
Apple added detections for this trojan to their XProtect (defined) anti-malware security feature; however as detailed in this TechRepublic article the trojans creators can easily modify it to avoid Apple’s signatures.
Further information on this trojan is available in this Softpedia article. TechRepublic provides a detailed list of recommendations within their article to prevent infection by this threat.
Thank you.
securityinaction 