Objcshellz

ObjCShellz is a lightweight malware written in Objective-C, known for its advanced obfuscation features. Discovered by Jamf Threat Labs in November 2023, this malware operates as a relatively simple backdoor, serving as a remote shell that allows an attacker to execute arbitrary commands. It's typically delivered as a second-stage payload to systems already compromised. The malware shares similarities with the RustBucket campaign, suggesting a link to the BlueNoroff APT group, which is associated with North Korea. The ObjCShellz malware was first identified as part of the RustBucket campaign, a series of cyber-attacks believed to be orchestrated by the BlueNoroff APT group. Researchers noted specific shared infrastructure between ObjCShellz payloads and SwiftLoader stagers, indicating a likely connection. Further investigation revealed that ObjCShellz is highly probable to be a later stage of the SwiftLoader SecurePDF Viewer.app, reinforcing the link between these malicious software tools. In response to the threat posed by ObjCShellz and other similar malware like RustBucket, KANDYKORN, SmoothOperator, Fullhouse, POOLRAT, PondRAT, OdicLoader, Comebacker, and CollectionRAT, we have implemented prevention and detection alerts. These measures are designed to protect systems from infection, disruption, data theft, or ransom attacks common to such malicious software. By understanding the nature of ObjCShellz and its connections to other malware campaigns, we can better anticipate and counteract these cybersecurity threats.