Threat Signal ReportNew MacOS Malware Variant - "Silver Sparrow" Affecting Over 30,000 MacOs Machines WorldWide
Description
FortiGuard Labs is aware of a newly discovered MacOS malware variant affecting over 30,000 computers in a global campaign. The malware dubbed "Silver Sparrow" was discovered by researchers at Red Canary. Classified as a downloader, what makes this MacOS variant unique is that there is no observed activity of a malicious payload being downloaded to victim machines. Another interesting observation is that the downloader has the capability to support the new Apple M1 ARM64 architecture which was recently released in late 2020, adding more intrigue about the malware itself and the threat actors behind it.
What are the Technical Details of the Threat?
Observations of the Silver Sparrow binaries highlight two different compiled binaries, one that is compiled for the Intel x86_64 architecture and another for the Intel x86_64 and M1 ARM64 architectures. Both files have similar names (update.pkg and updater.pkg) and both use a novel JavaScript execution routine. Further analysis is complicated because the routine uses a legitimate Mac installer process that does little to provide insight into the JavaScript commands being used by the installation package. To establish persistence, the malware uses plistbuddy, a built in tool to create property lists, including LaunchAgents. Finally, the LaunchAgent uses a process to execute a shell script that downloads a JSON file from a C2 server for further instructions.
What Operating Systems are Affected?
Mac Operating Systems.
How Serious of an Issue is This?
HIGH. This is due to the high installation rates and spread of the malware.
What is the Status of Coverage?
FortiGuard Labs has the following AV coverage in place for known Silver Sparrow samples as:
OSX/Agent.BL!tr
For FortiEDR protections, all published IOC's were added to our Cloud intelligence and will be blocked if executed on customer systems.
All Network IOC's related to this threat are blocked by the FortiGuard WebFiltering Client.
Any Other Suggested Mitigation?
Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.
Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.
