Tag Archives: Apple

If you follow the global threat landscape closely, then you may already be aware of a notorious Chinese hacking collective known as “Storm Cloud.” What few people know is that this group seems to be the driving force behind a new variant of malware that researchers have recently spotted in the wild.

Dubbed “GIMMICK” by the researchers at Volexity who first discovered it, the malicious code seems to be a custom tool designed and built by Storm Cloud specifically to target Mac users.

Once GIMMICK has found its way onto a target system, it quietly installs a trio of malware components called DriveManager, FileManager, and GCDTimerManager.

The DriveManager component gives the malware the following capabilities:

• Manage the Google Drive and proxy sessions.
• Maintain a local map of the Google Drive directory hierarchy in memory.
• Manage locks for synchronizing tasks on the Google Drive session.
• Handle download and upload tasks to and from the Google Drive session.

FileManager as the name indicates, manages the local directory where particulars relating to the command-and-control server are stored, along with the command tasks necessary for file exfiltration.

Finally, the GCDTimerManager handles the management of the various GCD objects.

The researchers at Volexity had this to say about the malware in their recently published report:

“Due to the asynchronous nature of the malware operation, command execution requires a staged approach. Though the individual steps occur asynchronously, every command follows the same.”

The bottom line is that this is a complex, robust malware strain. The good news is that the fine folks at Apple have found ways to guard against this latest threat.  The company has rolled out new protections to all supported macOS versions with new signatures for XProtect and MRT.

The new signatures that have been available since March 17, 2022 should protect users against GIMMICK. So if it’s been a while since you updated your OS, now is the time to do so.  Kudos to Apple for their rapid response here and to the sharp-eyed researchers at Volexity for spotting the new threat.

In late 2020 a new strain of malware called UpdateAgent appeared and began infecting Mac users.

Initially the strain wasn’t all that worrisome.  It stole system information but it was by no means the worst threat on a Mac user’s radar.

Since that time, the hackers behind the malicious code have been busy. UpdateAgent has received a few developments, with each one adding a new element of danger to the equation.  As things stand now UpdateAgent should be considered a serious threat to Mac users.

As of its latest iteration UpdateAgent installs an annoyingly persistent adware strain called Adload. It has gained capabilities that make it easy for UpdateAgent to install other even more threatening and damaging payloads in the future.

Microsoft has been investigating and following the development of UpdateAgent.  The company has discovered that the hackers who created the strain are hosting a wide range of other payloads on Amazon Web Services’ S3 and CloudFront services. While these have not yet been tied to UpdateAgent, it’s a clear sign of the shape of things to come.

In addition to that, the code is now capable of fetching compressed zip files instead of .dmg files. It has been modified to prevent Gatekeeper from displaying pop-up warnings to users.  It can also inject persistent code inside background processes that are invisible to the user.

Microsoft had this to say about their study of the malware strain:

“UpdateAgent is uniquely characterized by its gradual upgrading of persistence techniques, a key feature that indicates this trojan will likely continue to use more sophisticated techniques in future campaigns. 

Like many information-stealers found on other platforms, the malware attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.”

If UpdateAgent wasn’t on your radar before it certainly belongs there now.  It’s one to watch  out for in the year ahead.