XCSSET has introduced a method targeting macOS developers with version v40. Beyond the browser backdoor, the framework includes 17 modules and a new Telegram Desktop trojanizer that can remove genuine applications, replace them with attacker-supplied versions, sign them ad hoc for user reopening prompts, and more. Unit 42 advises monitoring unusual AppleScript activity, unexpected browser launch paths, unauthorized writes, and abnormal preferences domains created with the defaults utility.
Indicators of Compromise (IoCs):- Type Indicator Description C2 Domain accapple[. ]ru adschecks[. ]ru adsmobi[.
]ru adsmorein[. ]in adsmoreme[. ]in amdcdn[. ]ru amzndev[.
]in amzndev[. ]ru amznprod[. ]in applecdn[. ]ru appledisk[.
]ru appledns[. ]ru applehosts[. ]ru appletime[. ]in bulksec[.
]ru cdnamz[. ]in XCSSET v40 command-and-control domains C2 Domain cdnamz[. ]ru cdnapple[. ]in cdnatapple[.
]ru cdnroute[. ]ru checkcdn[. ]ru chromeads[. ]ru cnmag[.
]ru devnetaps[. ]ru dnsapple[. ]ru dnsrelays[. ]ru explorecdn[.
]ru fiddlejoy[. ]ru figmacat[. ]ru figmanets[. ]in funchats[.
]ru gironetcdn[. ]ru XCSSET v40 command-and-control domains C2 Domain goalmate[. ]ru googlenets[. ]ru greencn[.
]ru icloudsnet[. ]ru imails[. ]ru legalads[. ]in littleads[.
]in littledns[. ]ru maganet[. ]ru mindelgate[. ]ru netapsdev[.
]ru netcdnads[. ]in netcdnamz[. ]ru netcdndev[. ]in netcorps[.
]ru netsprot[. ]in XCSSET v40 command-and-control domains C2 Domain netsproto[. ]in networkads[. ]in rigacdn[.
]in rigmajoys[. ]in rigmanet[. ]ru rigmanets[. ]in sahusuzuki[.
]in stuffdns[. ]in testjoys[. ]ru timewebnet[. ]in vigmanet[.
]ru whitead[. ]in whiteads[. ]ru wincdn[. ]ru windsecure[.
]ru XCSSET v40 command-and-control domains C2 URL hxxps[:]//amzndev[. ]in/d/zw_sfp64 hxxps[:]//amzndev[. ]ru/d/zw_sfp64 hxxps[:]//googlenets[. ]ru/d/zw_sfp64 hxxps[:]//netcdndev[.
]in/d/zw_sfp64 hxxps[:]//whitead[. ]in/d/zw_sfp64 hxxps[:]//whiteads[. ]ru/d/zw_sfp64 Chrome CDP helper-binary download locations C2 IP Address 91.108.106[. ]229 95.142.35[.
]34 95.142.35[. ]206 95.142.37[. ]159 151.243.109[. ]188 178.208.92[.
]129 178.208.92[. ]168 XCSSET v40 command-and-control infrastructure SSL Thumbprint 6e480d648fa1b70612f5d198a66875e28847547d Shared SSL certificate thumbprint associated with operator infrastructure Deploy resilience against phishing and malware through the use of controlled threat intelligence platforms like MISP, VirusTotal, or your SIEM.
