Ankura CTIX FLASH Update - April 28, 2023

Malware Activity

North Korean-Tied "RustBucket" Malware Targeting Apple macOS Devices

"RustBucket," a new malware targeting Apple macOS devices, has been observed and attributed to the financially motivated North Korean threat group BlueNoroff, which is a subgroup of the Lazarus Group (APT28). Researchers discovered similarities between the observed campaign and a campaign noted in December 2022 targeting Windows machines. The similarities included "malicious tooling on macOS that closely aligns with the workflow and social engineering patterns of those employed in the campaign." The campaign consists of a stage-one malware containing a suspicious AppleScript file which is contained in an unsigned application called "Internal PDF Viewer.app." From there, the malware executes commands to download the stage-two malware from its command-and-control (C2) server, which is also called "Internal PDF Viewer.app." Researchers noted that the malware is broken up into