Ankura CTIX FLASH Update - December 12, 2023

Ransomware/Malware Activity

New Trojan Targets macOS Devices

A new trojan has been discovered in-the-wild targeting macOS, distributed through pirated versions of business software. The malware begins by disguising itself as a program the user is trying to download, but once it is installed it creates a hidden proxy server within the system. This creates a backdoor into the network and also allows for traffic to be redirected through the infected device. This can allow the threat actor to utilize the victim's network and devices for a variety of purposes such as use in a botnet, redirecting internet traffic through the network to obfuscate illegal activity, or further install more malware onto the network. The threat actors have configured the trojan to use DNS-over-HTTPS, also known as DoH, to trick security services into thinking the traffic is non-malicious in nature. This allows the trojan to communicate to the command-and-control (C2) server without alerting