Latest in Gear

Image credit:

Russia-backed malware can now target Macs

It's linked to the same group accused of hacking the Democrats.
Jon Fingas, @jonfingas
February 15, 2017
Share
Tweet
Share

Sponsored Links

Volkan Furuncu/Anadolu Agency/Getty Images

The state-backed Russian group accused of hacking the Democratic National Committee appears to be expanding its repertoire. Bitdefender Labs researchers have obtained a sample of a Mac-native variant of Xagent, the backdoor malware linked to Russia's APT28 (aka Fancy Bear or Strontium). The code not only allows swiping passwords and capturing screenshots, but includes a module that can swipe iOS device backups created by iTunes. While it's easy to encrypt those backups, this theoretically gives intruders a chance at snooping on iPhone data without having to compromise the iPhone itself.

As for the evidence? The modules in the Mac variant of Xagent show a "number of similarities" to the components for Linux and Windows, Bitdefenders says. The malware's command-and-control addresses are also eerily similar to the ones APT28 uses for another malware tool, Komplex.

There's still a lot left to be uncovered. The security team only has the malware itself, not a full picture of how an attack works -- Komplex, which infects Macs through a hole in the notorious MacKeeper antivirus kit, is one possible vector. It's also unclear what other modules are available. Either way, this isn't exactly comforting for Mac users who may find themselves in Russia's crosshairs. It's possible to protect against Xagent (Bitdefender says its AV software will work, and others likely will too), thankfully. The concern is that Russia might have already used the malware, or that it may target people who are unaware of the threat.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
Tweet
Share

Popular on Engadget

WhatsApp imposes even stricter limits on message forwarding

WhatsApp imposes even stricter limits on message forwarding

View
The Morning After: NASCAR driver loses sponsor after 'rage quitting' esports race

The Morning After: NASCAR driver loses sponsor after 'rage quitting' esports race

View
NASCAR driver 'rage quits' esports race

NASCAR driver 'rage quits' esports race

View
The first Lego Super Mario sets launch on August 1st

The first Lego Super Mario sets launch on August 1st

View
The gadgets that refuse to die

The gadgets that refuse to die

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr