North Korean crypto thieves deploy custom Mac backdoor – Source: www.csoonline.com

North Korean threat actors are targeting companies from the Web3 and crypto industries with a backdoor designed for macOS written in niche programming language Nim. The attackers are also using AppleScript for early stage payloads, including a fake Zoom update.

“North Korean-aligned threat actors have previously experimented with Go and Rust, similarly combining scripts and compiled binaries into multi-stage attack chains,” researchers from security firm SentinelOne said in a report on the threat. “However, Nim’s rather unique ability to execute functions during compile time allows attackers to blend complex behaviour into a binary with less obvious control flow, resulting in compiled binaries in which developer code and Nim runtime code are intermingled even at the function level.”

The targeting of organizations and high-value individuals with crypto assets is not uncommon for APT groups linked to the North Korean government. These groups are tasked to raise money for the government and be self-sufficient in funding their own operations. As such, North Korean hackers engage in both traditional cyberespionage and sabotage, as well as financial crime activities, including crypto theft, compromising financial institutions to initiate fraudulent transfers, and even ransomware.

Fake Zoom meeting invitations used as lure

The recent attack campaigns against crypto and Web3 companies started in April and were previously documented by Huntabil.IT and Huntress, who attributed the attacks to a North Korean subgroup that dates back to at least 2017 and is tracked in the security industry under different names: TA444, BlueNoroff, Sapphire Sleet, Copernicium, Stardust Chollima, or CageyChameleon.

The victims received messages on Telegram from impersonated contacts they knew and trusted, who invited them to schedule a meeting via Calendly, an appointment scheduling service. Subsequently they received a fake email with an invitation to a Zoom meeting, as well as instructions to run a “Zoom SDK update script.”

This script, called zoom_sdk_support.scpt, is written in AppleScript, a language developed by Apple for controlling macOS applications. This first-stage script is padded with 10,000 lines of white space to make it hard to read the malicious code, but its purpose is to download a second-stage script from another attacker-controlled domain that contains the word zoom. This second-stage script downloads an HTML script that redirects the user to a real Zoom meeting link as a distraction from the attack chain executing in the background.

A multi-staged infection process

The infection chain downloads two Mach-O binary applications, which in turn download additional components. The first application, called a, is written in C++ and writes an encrypted payload to disk in a file called netchk. It then proceeds to decrypt and execute a file called trojan1_arm64.

The benign file is executed first but the process is suspended and then the code of the trojan1_arm64 is injected into the memory of the suspended process and the process is resumed.

“This kind of process injection technique is rare in macOS malware and requires specific entitlements to be performed,” the researchers said.

What follows is more obfuscation and encrypted payloads, eventually resulting in two Bash scripts, upl and tlgrm, that exfiltrate data from the system and apps, such as various browsers and Telegram.

The second Mach-O binary is called installer and is compiled from Nim source code. Nim borrows concepts from several other programming languages, including Python, but is known for its high performance and speed compared to C and C++. It is not widely used except in niche applications.

This installer component drops additional payloads written in Nim, including one called GoogIe LLC and one called CoreKitAgent. These are used to set up persistence on the system by intercepting attempts to kill processes associated with this attack and restarting them through a LaunchAgent. The researchers dubbed this malware family NimDoor.

“Earlier this year, we saw threat actors utilizing Nim as well as Crystal, and we expect the choice of less familiar languages to become an increasing trend among macOS malware authors due both to their technical advantages and their unfamiliarity to analysts,” the SentinelOne researcher said. “As ever in the cat-and-mouse game of threat and threat detection, when one side innovates, the other must respond, and we encourage other analysts, researchers, and detection engineers to invest effort in understanding these lesser-known languages and how they will eventually be leveraged.”