MacMa

Macma is a malware, first detailed by Google in 2021, that has been used since at least 2019. It is a modular backdoor that supports multiple functionalities such as device fingerprinting, executing commands, screen capture, keylogging, audio capture, and uploading and downloading files. Macma, often used by Evasive Panda, is a macOS backdoor malware while POCOSTICK (aka MGBot) works on Windows systems. The malware infects systems via suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data hostage for ransom. The China-linked APT group exploited the privilege escalation vulnerability CVE-2021-30869 to install Macma on macOS devices. The attackers altered DNS responses for domains related to software updates to deploy multiple malware families, including Macma and POCOSTICK. Instead of installing the intended updates, these applications would install malware when they went to retrieve their updates. This strategy allowed the malware to enter systems often without the user's knowledge. The latest variant of Macma demonstrates the group converging development of both Macma and another malware known as Gimmick, according to Volexity. The attacks delivered new variants of the Macma backdoor, as well as post-exploitation malware to exfiltrate sensitive data from compromised networks. This highlights the evolving nature of cyber threats and the need for continuous vigilance and robust cybersecurity measures.