Warning: Apple macOS Devices Under Threat from Stealthy “RustDoor” Backdoor.

Apple macOS users, beware! A new backdoor named RustDoor has been quietly operating since November 2023. This Rust-based malware, associated with ransomware families, is cunningly disguised as an update for Microsoft Visual Studio. It targets both Intel and Arm architectures.

Apple macOS users are the target of a new Rust-based backdoor that has been operating under the radar since November 2023.
The backdoor, codenamed RustDoor by Bitdefender, has been found to impersonate an update for Microsoft Visual Studio and target both Intel and Arm architectures.
The exact initial access pathway used to propagate the implant is currently not known, although it’s said to be distributed as FAT binaries that contain Mach-O files.

The Romanian cybersecurity firm said the malware is likely linked to prominent ransomware families like Black Basta and BlackCat owing to overlaps in C2 infrastructure.

“ALPHV/BlackCat is a ransomware family (also written in Rust), that first made its appearance in November 2021, and that has pioneered the public leaks business model,” security researcher Andrei Lapusneau said.

In December 2023, the U.S. government announced that it took down the BlackCat ransomware operation and released a decryption tool that more than 500 affected victims can use to regain access to files locked by the malware.

Here are the key details about RustDoor:

• Initial Access Pathway: The exact method of propagation remains undisclosed, but it is distributed as FAT binaries containing Mach-O files.
• Variants: Multiple versions of the malware have been detected, suggesting active development. The earliest sample dates back to November 2, 2023.
• Functionality: RustDoor comes equipped with a wide range of commands, allowing it to gather and upload files and harvest information from compromised endpoints.
• Exfiltration: The captured data is sent to a command-and-control (C2) server.
• Ransomware Connection: RustDoor’s infrastructure overlaps with prominent ransomware families like Black Basta and BlackCat. The latter, also written in Rust, pioneered the public leaks business model.

Key Steps to Recognize and Combat the RustDoor Backdoor Threat on Apple macOS.

1. Isolate the System:
   • Disconnect your Mac from the network to prevent further communication with the command-and-control (C2) server.
   • Disable Wi-Fi and unplug any Ethernet cables.
2. Scan for Malware:
   • Use a reputable antivirus or anti-malware software to scan your system thoroughly.
   • Ensure that the software is up to date with the latest virus definitions.
3. Remove Suspicious Files:
   • Search for any files related to RustDoor. Pay attention to the following locations:
     • /Library/LaunchDaemons
     • /Library/LaunchAgents
     • /Library/Application Support
     • /Library/Extensions
     • /Users/<YourUsername>/Library/LaunchDaemons
     • /Users/<YourUsername>/Library/LaunchAgents
   • Delete any suspicious files or directories associated with RustDoor.
4. Check Startup Items:
   • Go to System Preferences > Users & Groups > Login Items.
   • Remove any unknown or suspicious items from the list.
5. Review Recent Software Updates:
   • Verify that any recent software updates were legitimate.
   • RustDoor masquerades as an update for Microsoft Visual Studio, so check for any unexpected updates related to Visual Studio.
6. Monitor Network Traffic:
   • Use network monitoring tools to check for any unusual outbound connections.
   • Look for communication with suspicious IP addresses.
7. Change Credentials:
   • Change your passwords for critical accounts (email, banking, etc.).
   • RustDoor may have harvested sensitive information.
8. Update macOS:
   • Ensure that your macOS is updated to the latest version.
   • Security patches may address vulnerabilities exploited by RustDoor.
9. Backup and Reinstall:
   • Backup your important files.
   • Reinstall macOS from a trusted source (e.g., Apple’s official website).
   • This will wipe out any potential malware.
10. Stay Informed:
    • Keep an eye on security news and updates related to RustDoor.
    • Follow best practices for cybersecurity.

You think you have a story worth everyone’s time? SUBMIT A STORY and we will publish it.