Kaspersky researchers have discovered newer versions of Milum, a malicious Trojan used by WildPressure, capable of infecting and running on both Windows and macOS systems.

 

In threat hunting, many discoveries unravel from a small clue, and this campaign is no exception. Often, once a device is infected by a Trojan, the malware sends a beacon to the attackers’ servers, which contains information about the device, network settings, user name and other relevant information. 

 

This helps the attackers determine whether an infected device is of any interest. However, in the case of Milum, it also sent information about the programming language in which it was written. 

 

When first investigating the campaign in 2020, Kaspersky researchers suspected that this pointed to the existence of different versions of this Trojan in different languages. Now this theory has been confirmed.

In spring 2021, Kaspersky identified a new attack by WildPressure, which was carried out with a set of newer versions of the Milum malware. The files discovered contained the Milum Trojan written in C++ and a corresponding Visual Basic Script (VBScript) variant. 

 

Further investigation into this attack uncovered another version of the malware written in Python, which was developed for both Windows and macOS operating systems. All three versions of the Trojan were able to download and execute commands from the operator, collect information, and upgrade themselves to a newer version.

 

Multi-platform malware capable of infecting devices that run on macOS is rare. This particular specimen was delivered in a package, which included the malware, Python library and a script named ‘Guard’. This enabled the malware to launch both on Windows and macOS with little additional efforts. Once infecting the device, the malware runs operating system-dependent code for persistence and data gathering. On Windows, the script is bundled into an executable with a PyInstaller. The Python Trojan is also capable of checking whether security solutions are being run on a device.

 

“WildPressure operators retain their interest in the same geographical area. Malware authors developed multiple versions of similar Trojans, and they have a versioning system for them. The reason behind the development of similar malware in multiple languages is most probably  to decrease the likelihood of detection. This strategy is not unique among APT actors, but we rarely see malware that is adapted to run on two systems at once, even in the form of a Python script. Another curious feature is that one of the targeted operating systems is macOS, which is a surprising target given the geographical interest of the actor,” comments Denis Legezo, senior security researcher at GReAT, Kaspersky. -- TradeArabia News Service