Swiftloader

SwiftLoader is a sophisticated malware that functions as a PDF viewer to lure unsuspecting victims. It was initially used in the RustBucket campaign, where it served as a second-stage malware, infecting systems through seemingly innocent downloads such as documents sent to targets. Notably, SwiftLoader has been observed to run on both Intel and Apple Silicon hardware, demonstrating its broad reach and potential for damage. The malware operates by retrieving and executing further stage malware written in Rust while victims view the lure document. There are intriguing overlaps between SwiftLoader and the KandyKorn operation, suggesting a connection. Our research indicates that SwiftLoader droppers have been used to deliver KandyKorn payloads, revealing a trend among DPRK threat actors of 'mixing and matching' components from these operations. Furthermore, we've identified shared infrastructure between ObjCShellz payloads and SwiftLoader stagers, suggesting that ObjCShellz is likely a later stage of the SwiftLoader SecurePDF Viewer.app. Several versions of SwiftLoader have been detected in the wild, including one distributed under the guise of a file named "Crypto-assets and their risks for financial stability.app.zip". This particular variant had multiple elements linking it to the KandyKorn operation. These findings underscore the evolving nature of cyber threats and the need for continuous vigilance and robust cybersecurity measures to protect against such harmful software.