Back to School Reminder - Keep Your Mac Clean!

Key points from our research:

• Around early-mid August, we noticed an increase in MacOS malware detections, specifically AdLoad and UpdateAgent in IronDome, in the education sector. This timing correlates with students returning to school, therefore bringing their personal (infected) devices to school networks, and is likely the cause of this increase.
• Our CyOC discovered previously unreported IOCs relating to AdLoad and UpdateAgent, including HTTP User Agents, HTTP Paths, and domains. Additionally, some IOCs discovered have been reported since 2019, which indicates the techniques the threat actors are using have been around for years and continue to compromise systems. These IOCs are available in the Appendix section.
• IronDefense was able to detect this activity via multiple different analytics, including our Suspicious File Download, Beaconing, and Domain Analysis behavioral analytics. IronDome correlated this activity together and uncovered five more enterprises affected.

Executive Summary

IronNet has observed an increase in MacOS malware within IronDome’s Education sector over the past couple of weeks. Our Cyber Operations Center’s (CyOC) investigations into these incidents found these infections were originating from already-infected personal devices that were brought into education networks, with the majority of these occurring at higher education institutions. The most prevalent malware strains we have observed include AdLoad, a package bundler that downloads additional payloads, and UpdateAgent, a trojan that we observed stealing basic system information. 

This surge in MacOS malware detections aligns with students returning to school - which also contributes to our analysis that the systems these detections originated from are personal devices. This serves as a reminder that Bring Your Own Device (BYOD) policies are of the utmost importance, especially that any BYOD devices should not be inherently trusted and should be segregated from internal enterprise resources. 

AdLoad/UpdateAgent

Overview

Beginning August 18th, 2023, IronDefense detected activity based on the Suricata rule ET MALWARE MacOS/Adload CnC Beacon. Upon initial investigation, IronNet threat hunters identified additional activity that varied from previously reported AdLoad IoCs. We observed a previously unreported C2 communications and a new subdomain pattern used for secondary downloads, static.<two-word-domain>.com.

Malware Command and Control (C2) Behavior:

1. The victim host conducts HTTP GET requests to a C2 domain with two device unique variables, a 6 digit number and UUID string. These requests have user agent strings of either Go-http-client or curl, and result in an HTTP 404 response.

2. C2 activity begins via HTTP POST consistent with previously reported AdLoad C2 communications. The string smc is found at the start of the data portion of the POST request, followed by encrypted data.

3. An additional payload is downloaded from static.<domain>/d/<38 digit string>/<filename>, which contains a password-protected zip file. At the time of writing, IronNet has been unable to access the contents of this zip file.

4. C2 activity continues, however the user agent changes to the name of the file found within the encrypted zip archives.

5. Additional HTTP GET requests to a C2 domain are observed using the same variables as the initial activity, however with different HTTP Path values. These sessions also result in an HTTP 404 response.

6. Additional payloads are downloaded using the same format, and the C2/Download cycle repeats.

UpdateAgent

Additionally, encrypted communications over TCP port 1027 were observed to qolveevgclr.activedirec[.]com and b.digitalgrounds[.]info. The domain qolveevgclr.activedirec[.]com was reported as a C2 domain for UpdateAgent in a Microsoft blog post from 2022, where Microsoft identified AdLoad as a secondary payload delivered by UpdateAgent. Since the systems we observed were compromised prior to joining the network, we are unable to confirm the sequence of events relating to UpdateAgent potentially dropping AdLoad as a secondary payload. While APT's and ransomware actors who target businesses and large organizations have realized the need to regularly cycle their infrastructure (domains and IP’s), threat actors targeting individuals have not needed to do this to remain effective.

Additional Observations

Overview

IronNet detected suspicious activity across the same education customer environments that, while sharing some similarities, does not appear to be related to UpdateAgent/AdLoad. We observed encrypted C2 communications to various domains, and additional payload downloads from zip archives. The first downloaded zip contained an unknown Mach-O binary that had no negative reputation in VirusTotal, while the second contained Genieo adware, a MacOS browser hijacker. The Genieo binary was being hosted on a C2 domain that the infected devices were communicating with. Like the UpdateAgent/AdLoad activity, IronNet Threat Hunters were unable to identify the initial infection source due to the devices being compromised prior to joining the network.

Malware C2 Behavior:

1. The victim host begins C2 activity via an HTTP POST to <domain>/reader-update, which contains a device_id= parameter unique to the host.

2. Follow-on HTTP POST activity is observed to /<one word>-search/<9 digit identifier> with additional host information, including: unique host identifiers, references to two domains associated with browser hijackers, and various Chrome extension names. This activity contains a state= parameter which in this case was set to periodic check.

3. C2 activity begins to /squirrel-log with an encrypted data string that contains two parameters: _iv= and _payload=. The C2 server responded with an acknowledgement. 

4. An HTTP request to <domain>/static/apps/<name>.zip is observed. In this session, 437.zip was downloaded, which contained a Mach-O binary named V6QED2Q1WBYVOPE. Interestingly, this has no negative ratings or reports in VirusTotal and attempts to execute the binary in sandboxes were unsuccessful at identifying what this file is. 

5. A C2 session to <domain>/kitten-update where additional download instructions are sent to the victim host.

6. An additional payload is downloaded per the C2 download instructions. In the activity outlined, this downloaded a zip file centurion.zip, which contained the file CompanyUpdate. After uploading to VirusTotal, it was identified as Genieo adware.

7. C2 activity resumes with a request to /doggy-update/<9 digit identifier>/<40 digit string>, which returns a failed response from the C2 server.

IronDome Correlations

We rated all alerts associated with these campaigns as malicious, and when this happens, IronDome creates Threat Intelligence Rules for the IOCs associated with the activity and pushes those rules to all IronDefense instances, as well as comments that the analyst adds to provide context to other analysts triaging this same activity. These Threat Intelligence Rules uncovered additional activity in other IronDome participants which prompted additional investigations, and enabled us to discover the uptick in MacOS malware detections within the Education sector. 

IronDome correlated this activity within six enterprises, three behavioral analytics, and also the Suricata rule ET MALWARE MacOS/Adload CnC Beacon. To give an idea of what this looks like for IronNet analysts and threat hunters, below is an example of one of the domains in our Indicator Intelligence page within our Collective Defense Portal (CDP):

Displayed above, IronDefense generated three unique alert subcategories for this activity, including Suspicious File Download, Beaconing, and Domain Analysis HTTP. This immediately provides additional context to the analyst about this activity, informing them of the behaviors that are occurring and helping them prioritize what and how to triage. Additionally, albeit being sanitized in the screenshot, we are able to quickly determine all of the IronDefense instances affected, as well as see comments about the behaviors. 

Summary

BYOD brings inherent risks to an enterprise, especially when considering the devices are untrusted and can be infected with malware prior to connecting to an enterprise network. Given this, it is imperative to have strict BYOD policies and technical controls, such as network segmentation, to limit the risk that BYOD presents to your network. Adversaries continue to target personal devices as a means to either gain access to loosely secured networks or to gain enterprise credentials or information stored on personal devices.

The IronDome platform was able to correlate three unique behaviors across the Education sector, which enabled us to prioritize and investigate this activity further. This led to our analysts uncovering this trend of previously-compromised devices being detected on Education networks, which closely aligns with the timing of students returning to school. 

Detections

Appendix (IOCs)

Domains:

Files: