An unknown cryptocurrency exchange located in Japan was the target of a new attack earlier this month to deploy an Apple macOS backdoor called JokerSpy.
Elastic Security Labs, which is monitoring the intrusion set under the name REF9134, said the attack led to the installation of Swiftbelt, a Swift-based enumeration tool inspired by an open-source utility called SeatBelt.
JokerSky was first documented by Bitdefender last week, describing it as a sophisticated toolkit designed to breach macOS machines.
Very little is known about the threat actor behind the attacks other than the fact that the attacks leverage a set of programs written in Python and Swift that come with capabilities to gather data and execute arbitrary commands on compromised hosts.
A primary component of the toolkit is a self-signed multi-architecture binary known as xcc that’s engineered to check for FullDiskAccess and ScreenRecording permissions.
The file is signed as XProtectCheck, indicating an attempt to masquerade as XProtect, a built-in antivirus technology within macOS that makes use of signature-based detection rules to remove malware from already infected hosts.
In the incident analyzed by Elastic, the creation of xcc is followed by the threat actor “attempting to bypass TCC permissions by creating their own TCC database and trying to replace the existing one.”
“On June 1, a new Python-based tool was seen executing from the same directory as xcc and was utilized to execute an open-source macOS post-exploitation enumeration tool known as Swiftbelt,” security researchers Colson Wilhoit, Salim Bitam, Seth Goodwin, Andrew Pease, and Ricardo Ungureanu said.
The attack targeted a large Japan-based cryptocurrency service provider focusing on asset exchange for trading Bitcoin, Ethereum, and other common cryptocurrencies. The name of the company was not disclosed.
The xcc binary, for its part, is launched by means of Bash via three different apps that are named IntelliJ IDEA, iTerm (a terminal emulator for macOS), and Visual Studio Code, indicating that backdoored versions of software development software are likely used to gain initial access.
Another notable module installed as part of the attack is sh.py, a Python implant that’s used as a conduit to deliver other post-exploitation tools like Swiftbelt.
“Unlike other enumeration methods, Swiftbelt invokes Swift code to avoid creating command line artifacts,” the researchers said. “Notably, xcc variants are also written using Swift.”
