Rustbucket

RustBucket is a malicious software (malware) specifically targeting macOS systems, first reported in 2023 and attributed to the North Korea-linked threat actor group, BlueNoroff. This malware was initially uncovered in 2021 as part of the RustBucket campaign and has since evolved into multiple variants with similar characteristics to BlueNoroff's original RustBucket variant. The malware is typically deployed in three stages, with most infections blocked by Cortex XDR during the download of the next stage. RustBucket is associated with a series of other malware campaigns including KANDYKORN, SmoothOperator, ObjCShellz, Fullhouse, POOLRAT, PondRAT, OdicLoader, Comebacker, and CollectionRAT. The RustBucket malware is part of a broader campaign named "Hidden Risk," primarily targeting cryptocurrency businesses. The threat actors use deceptive tactics such as fake cryptocurrency news emails and a malicious app disguised as a PDF to infiltrate systems. Notably, RustBucket features a cross-platform backdoor written in Rust, attributed to DPRK's Lazarus Group, with a macOS version first spotted in 2023. SentinelLabs researchers have identified similarities between RustBucket and the ObjCShellz malware, reinforcing the association with the BlueNoroff APT group. In April, security firm Jamf reported that the BlueNoroff APT group was using a new macOS malware dubbed RustBucket. By July 2023, Elastic Security Labs had identified a new variant of the RustBucket Apple macOS malware. To combat these threats, preventive measures and detection alerts have been implemented for each type of malware. Despite these efforts, the RustBucket campaign continues to pose a significant cybersecurity threat, particularly to organizations operating within the cryptocurrency sector.