MacMa

Macma is a malicious software (malware) first detailed by Google's Threat Analysis Group (TAG) in 2021, although it had been in use since at least 2019. Known as OSX.MacMa or simply Macma, this malware is a backdoor designed to exploit macOS systems, and has been frequently employed by the Evasive Panda group. The malware is modular in nature, supporting multiple functionalities such as device fingerprinting, executing commands, screen capture, keylogging, audio capture, and uploading and downloading files. It can infiltrate a system through suspicious downloads, emails, or websites, often without the user's knowledge. The China-linked Advanced Persistent Threat (APT) group has been observed using an updated version of the Macma backdoor. This new variant shows a convergence in the development of Macma and another piece of malware known as Gimmick. In their attack strategy, the adversaries manipulated DNS responses for domains related to software updates to deploy various malware families, including Macma and Pocostick (also known as MGBot). Consequently, when applications attempted to retrieve their updates, they unknowingly installed malware instead of the intended update. The attackers exploited the privilege escalation vulnerability CVE-2021-30869 to install Macma on macOS devices. Once inside, the malware could exfiltrate sensitive data from compromised networks. Notably, while Macma targets macOS systems, its counterpart Pocostick or MGBot is designed to work on Windows systems. The continuous evolution of these malware variants and their deployment strategies underscores the persistent threat posed by APT groups and the need for robust cybersecurity measures.