Rustbucket

RustBucket is a malicious software (malware) campaign that was first reported in 2023 and has been attributed to the BlueNoroff group, which was initially discovered in 2021. This malware specifically targets macOS systems and is considered a later-stage variant of the original RustBucket malware due to their similar characteristics. The malware operates in multiple stages and is often spread via an application disguised as a PDF viewer. Since its initial discovery, various variants of RustBucket have been observed, indicating ongoing development and adaptation by its creators. In April 2024, the North Korea-linked Advanced Persistent Threat (APT) group, BlueNoroff, was observed utilizing a new variant of the RustBucket malware. Then, in July 2023, researchers from Elastic Security Labs spotted another variant of the RustBucket malware. Notably, experts have found similarities between the RustBucket malware and another malware known as ObjCShellz, suggesting possible shared origins or techniques. To combat this threat, prevention and detection alerts for RustBucket, along with other types of malware such as KANDYKORN, SmoothOperator, ObjCShellz, Fullhouse, POOLRAT, PondRAT, OdicLoader, Comebacker, and CollectionRAT, have been implemented. Cortex XDR has shown effectiveness in blocking RustBucket samples from downloading subsequent stages of malware, thus mitigating potential damage. Jamf Threat Labs reported attackers using RustBucket as part of their campaigns, underscoring the ongoing threat posed by this malware.