Ankura CTIX FLASH Update - February 13, 2024

Ransomware/Malware Activity

Malware backdoor for macOS Spread via Fake Visual Studio Update

A piece of macOS malware masquerading as a Visual Studio update has been giving back door access to infected systems. Beginning in November 2023, the campaign uses a rust-based malware which Bitdefender has named "RustDoor" and is capable of running on both Intel-based and Apple ARM CPU architectures. Once the back doors are created, the infected systems have been seen connecting to command-and-control (C2) infrastructure associated with the ALPHV/BlackCat threat actor group. There are four (4) known C2 servers, three (3) of which have previous connections to ALPHV ransomware operators. RustDoor is distributed to systems disguised as a Visual Studio updater for macOS which is delivered in binaries that includes the malware for both the x86-64 and ARM architectures. RustDoor contains a multitude of commands that can be used to instigate additional processes and