NordVPN Promotion

Home / Industry

XCSSET Shows How Threat Actors Cope with OS Changes, Does Away with Python Like macOS

Protect your privacy:  Get NordVPN  [ Deal: 73% off 2-year plans + 3 extra months ]
10 facts about NordVPN that aren't commonly known
  • Meshnet Feature for Personal Encrypted Networks: NordVPN offers a unique feature called Meshnet, which allows users to connect their devices directly and securely over the internet. This means you can create your own private, encrypted network for activities like gaming, file sharing, or remote access to your home devices from anywhere in the world.
  • RAM-Only Servers for Enhanced Security: Unlike many VPN providers, NordVPN uses RAM-only (diskless) servers. Since these servers run entirely on volatile memory, all data is wiped with every reboot. This ensures that no user data is stored long-term, significantly reducing the risk of data breaches and enhancing overall security.
  • Servers in a Former Military Bunker: Some of NordVPN's servers are housed in a former military bunker located deep underground. This unique location provides an extra layer of physical security against natural disasters and unauthorized access, ensuring that the servers are protected in all circumstances.
  • NordLynx Protocol with Double NAT Technology: NordVPN developed its own VPN protocol called NordLynx, built around the ultra-fast WireGuard protocol. What sets NordLynx apart is its implementation of a double Network Address Translation (NAT) system, which enhances user privacy without sacrificing speed. This innovative approach solves the potential privacy issues inherent in the standard WireGuard protocol.
  • Dark Web Monitor Feature: NordVPN includes a feature known as Dark Web Monitor. This tool actively scans dark web sites and forums for credentials associated with your email address. If it detects that your information has been compromised or appears in any data breaches, it promptly alerts you so you can take necessary actions to protect your accounts.

Just as software and hardware vendors push upgrades and updates for their products and services to stay secure against the latest threats, so do threat actors work as fast as possible to stay abreast of OS and version modifications. That’s exactly what the XCSSET malware operators have done for their campaigns targeting macOS users to continue working.

When macOS Monterey removed support for Python, so did XCSSET, which relied heavily on the language in the past. Otherwise, related campaigns won’t work against the users of the latest macOS.

Using the eight domains and one IP address identified by SentinelOne as indicators of compromise (IoCs) as a jump-off point, we discovered:

  • Additional domains hosted on the same IP address
  • More than 100 additional domains that contained the same strings as the IoCs
  • Unredacted email addresses used to register the additional domains
  • Nearly 1,000 additional domains that shared the unredacted email addresses
  • More than 20 of the total number of additional domains dubbed “malicious” by various malware engines

A sample of the additional artifacts obtained from our analysis is available for download from our website.

Threat Analysis and Findings

We began our in-depth look at XCSSET by subjecting the eight domains identified as IoCs to Connected Domains API lookups and found that seven of them resolved to 45[.]82[.]153[.]92—also named an IoC. Only cosmodron[.]com didn’t resolve to the IP said address at any point in time.

Using 45[.]82[.]153[.]92 as a reverse IP lookup search string, meanwhile, allowed us to uncover an additional nine domains that haven’t been mentioned in XCSSET-related reports. These are:

  • admobs[.]ru
  • cosmodron[.]com
  • linebrand[.]xyz
  • melodyapps[.]ru
  • monotel[.]xyz
  • nodeline[.]xyz
  • sidelink[.]xyz
  • statsmag[.]ru
  • yahooads[.]ru

We didn’t stop there, though, since we want to identify as many artifacts as possible to help users better protect against ongoing malicious campaigns.

We then sought to find domains that used the same strings as the IoCs and additional artifacts albeit different top-level domain (TLD) extensions. Using the strings “superdocs,” “melindas,” “kinksdoc,” “gurumades,” “gismolow,” “appledocs,” “adobefile,” “cosmodron,” “admobs,” “linebrand,” “melodyapps,” “monotel,” “nodeline,” “sidelink,” “statsmag,” and “yahooads”

as Domains & Subdomains Discovery search strings. That led to the discovery of 126 more artifacts.

Performing a bulk WHOIS lookup for all the domains found so far then uncovered six unredacted personal email addresses used to register the properties. These are:

  • linxxxxx@gmail[.]com
  • xxxxx@monotel[.]com[.]tr
  • engineexxxxx@hotmail[.]com
  • xxxxx@monotel[.]com
  • suxxxxx@superior-docs[.]com
  • domain-xxxxx@oath[.]com

Using these email addresses as reverse WHOIS search strings allowed us to uncover 900 additional domains.

After collating a total of 1,035 artifacts that haven’t been publicized in XCSSET-related reports, we ran them through a bulk malware check on Threat Intelligence Platform (TIP). We found that 23 of them hosted malware.

Concluding Thoughts

While the removal of support for Python on macOS Monterey may have stopped old XCSSET versions from affecting users, the malicious operators’ fast adaptation ensures the latest iteration of their malware will.

Security teams who wish to protect networked-connected Macs from XCSSET may be interested in monitoring access to and from the 1,000+ domains we identified as artifacts and block access to the 23 malicious domains.

If you wish to perform a similar investigation or get access to the full data behind this research, please don’t hesitate to contact us.

By Threat Intelligence Platform (TIP), Enterprise-Grade Threat Intelligence APIs, Tools, and Services

Threat Intelligence Platform (TIP) offers easy to use threat intelligence tools, services, and APIs to get detailed information about hosts and the infrastructure behind them. Gathering data from different providers, utilizing our substantial internal databases (compiled for 10+ years), and also real-time host configuration analysis, our threat intelligence solutions provide an in-depth look at target hosts and are an essential addition to any threat detection toolkit.

Visit Page

Filed Under

Comments

Commenting is not available in this channel entry.
CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

Cybersecurity

Sponsored byVerisign

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global

Domain Names

Sponsored byVerisign

DNS

Sponsored byDNIB.com

Threat Intelligence

Sponsored byWhoisXML API

New TLDs

Sponsored byRadix

NordVPN Promotion