Ankura CTIX FLASH Update - May 7, 2024

Ransomware/Malware Activity

Cuckoo InfoStealer Malware Targets MacOS Systems

Cybersecurity Researchers at Kandji have discovered a Mach-O binary malware built to infect both Intel and ARM-based MacOS systems. Cuckoo is being distributed by websites that claim to provide applications designed to rip music from streaming services into MP3 format. The malicious binary is named "upd" and is not signed with a developer ID, which means victims would need to ignore MacOS's Gatekeeper security warning to allow execution. Once the malware is allowed to run, it performs a locale check to ensure the infected device is not in Armenia, Belarus, Kazakhstan, Russia, or the Ukraine and then installs LaunchAgent for persistence. This is a technique seen in many previous MacOS malware families. Cuckoo is designed to steal as much information from the victim machine as possible. The malware also leverages osascript to display fake password prompts to trick victims into entering