Categories: SecurityWorkspace

Mac Trojan Is Cyber Spying Tool, Say Experts

A Mac Trojan aimed at Apple systems is actually a cyber espionage tool that can be bought online from an Italian hacking group, security researchers have claimed.

The malware, which is being sold in competition to tools such as FinSpy, which British firm Gamma International has been accused of selling to repressive regimes in Egypt and Bahrain, has various names – Crisis, Morcut and DaVinci – and operates as a backdoor, providing attackers remote acess to infected systems.

Research from Russian firm Dr. Web noted the Mac Trojan was developed by an Italian organisation called HackingTeam – a claim backed up by F-Secure’s chief research officer Mikko Hypponen – and it comes with rootkit technologies to hide itself.

This is the first time a piece of Mac malware has been seen with rootkit capabilities, Dr. Web said. It can also infect Windows machines and the security firm said a mobile version was known to exist.

For criminals or governments?

“The Trojan saves and transmits information about the infected machine to criminals, acts as a key logger, can take screenshots, and intercept e-mail, ICQ [an instant messaging computer program], Skype messages and data captured by a microphone or video camera connected to a computer,” Dr Web blogged.

“In addition, the backdoor has a large set of tools to bypass anti-virus software and firewalls, so it may run unnoticed in a system for a long time.

“HackingTeam criminals call their brainchild a 21st-century weapon and sell BackDoor.DaVinci.1 as a remote control and espionage solution.”

The HackingTeam claims to work for law enforcement and intelligence communities, not for criminals. It openly advertises its Da Vinci “hacking suite for governmental interception” on its website.

Hypponen said on Twitter that what the HackingTeam were offering was a competitor to the FinSpy software offered by British firm Gamma International, which has been implicated in selling surveillance gear to repressive regimes in Egypt and Bahrain. The UK government is currently being threatened with legal action unless it places tighter controls on the export of technology such as FinSpy.

Trend Micro issued its own post on the malware today, saying it would not run on the latest Mac OS, Mountain Lion, which was released earlier this week. However, its “apparent inability to run on Mountain Lion may be premature, as we know malware creators are capable of ‘updating’ and spawning variants within hours,” Trend said.

“With Mountain Lion’s release, it is likely that we will soon see newer samples, or even a new threat, that will attempt to target Mountain Lion.”

No attacks using the Trojan, which can infect older Mac systems than Mountain Lion, have been seen in the wild.

Many have warned cyber criminals will increasingly target Apple Macs as they grow in popularity. The Flashback Trojan that infected over 600,000 Macs was viewed as a sign of things to come.

Like Internet anonymity? Try our Anonymous quiz!

Thomas Brewster

Tom Brewster is TechWeek Europe's Security Correspondent. He has also been named BT Information Security Journalist of the Year in 2012 and 2013.

Recent Posts

Australia Rejects Elon Musk Claim About Social Media Ban For Under-16s

Government minister flatly rejects Elon Musk's “unsurprising” allegation that Australian government seeks control of Internet…

44 mins ago

Northvolt Files For Bankruptcy Protection In US

Northvolt files for Chapter 11 bankruptcy protection in the United States, and CEO and co-founder…

2 hours ago

UK’s CMA Readies Cloud Sector “Behavioural” Remedies – Report

Targetting AWS, Microsoft? British competition regulator soon to announce “behavioural” remedies for cloud sector

18 hours ago

Former Policy Boss At X Nick Pickles, Joins Sam Altman Venture

Move to Elon Musk rival. Former senior executive at X joins Sam Altman's venture formerly…

20 hours ago

Bitcoin Rises Above $96,000 Amid Trump Optimism

Bitcoin price rises towards $100,000, amid investor optimism of friendlier US regulatory landscape under Donald…

22 hours ago

FTX Co-Founder Gary Wang Spared Prison

Judge Kaplan praises former FTX CTO Gary Wang for his co-operation against Sam Bankman-Fried during…

22 hours ago