BlueNoroff strikes again with new macOS malware (ObjCShellz) · November 6 2023
Jamf Threat Labs has identified a new malware variant attributed to the BlueNoroff APT group. BlueNoroff's campaigns are financially motivated, frequently targeting cryptocurrency exchanges, venture capital firms and banks.
Cryptocurrency exchanges, venture capital firms and banks · 06/11/2023
Researchers from Jamf discover a new campaign by the North Korean-backed BlueNoroff threat group targeting Apple customers with a new macOS malware tracked as ObjCShellz that can open remote shells on compromised devices. [Date Occurred: During September and October 2023; Date Discovered: During September and October 2023]
bluenoroff-strikes-again-with-new-macos-malware/ · November
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 57 of 75, PDF p. 329). DPRK cyber actor: BlueNoroff; Report Name: bluenoroff-strikes-again-with-new-macos-malware/; Case Summary: A new later -stage malware variant from BlueNoroff was discovered. BlueNoroff reached out to a target claiming to be interested in partnering with or offering something beneficial under the guise of an investor or head hunter.; Publication Month: November
“BlueNoroff strikes again with new macOS malware,” Jamf Threat Labs · 6 November 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 7: “BlueNoroff strikes again with new macOS malware,” Jamf Threat Labs, 6 November 2023. Summary: A BlueNoroff malware variant dubbed “ObjCShellz” was discovered that shares characteristics with the previously-reported RustBucket campaign. ... the malware was observed communicating with malicious domain “swissborg[.]blog.”