Rustbucket

RustBucket is a malicious software (malware) campaign that was first uncovered in 2021 and attributed to BlueNoroff, a North Korea-linked Advanced Persistent Threat (APT) group. The malware is known for its ability to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. RustBucket primarily targets macOS devices, spreading its malicious payload via an app disguised as a PDF viewer. In April 2024, the security firm Jamf observed BlueNoroff using a new macOS malware variant, dubbed RustBucket. In July 2023, researchers from Elastic Security Labs spotted a new variant of the RustBucket Apple macOS malware. A subsequent discovery in December 2023 revealed a new Trojan attacking macOS users, also associated with the BlueNoroff APT group and their ongoing RustBucket campaign. This discovery included a new type of malicious loader targeting macOS, which experts believe is linked to the RustBucket campaign. Another malware, ObjCShellz, was identified as part of the RustBucket campaign due to its similarities with other RustBucket variants. The Lazarus Group, another North Korean hacker collective, has reportedly leveraged a key component of the RustBucket campaign, SwiftLoader, to distribute the KANDYKORN malware. SentinelOne, a cybersecurity company, has confirmed protection for its customers from both KandyKorn and RustBucket malware. The RustBucket campaign is characterized by its deployment of a backdoored version of a PDF reader app called SwiftLoader, further solidifying its focus on macOS systems.