Ankura CTIX FLASH Update - July 7, 2023

Ransomware/Malware Activity

Researchers Identified New "RustBucket" Variant with Evolved Capabilities

Researchers have discovered a new variant of the "RustBucket" malware that is currently targeting Apple macOS users. The RustBucket malware family has been previously attributed to BlueNoroff, a North Korean subgroup of the Lazarus Group, and was first identified in April 2023. The variant, described as the "first instance of BlueNoroff malware specifically targeting macOS users," is known as a second-stage malware that compiles in Swift and, as of June 29, 2023, has zero (0) detections on VirusTotal, a malware analyzing tool. The RustBucket variant has a persistence capability that is new to the RustBucket malware family, where it establishes its own persistence by adding a "plist" file at a specific path and copies its binary to an additional path. The malware is also currently "leveraging a dynamic network infrastructure methodology" for its