“RustBucket”, a new malware targeting Apple macOS devices, has been observed and attributed to the financially motivated North Korean threat group BlueNoroff, which is a subgroup of the Lazarus Group (APT28). Researchers discovered similarities between the observed campaign and a campaign noted in December 2022 targeting Windows machines. The similarities included “malicious tooling on macOS that closely aligns with the workflow and social engineering patterns of those employed in the campaign.” The campaign consists of a stage-one malware containing a suspicious AppleScript file which is contained in an unsigned application called “Internal PDF Viewer.app”. From there, the malware executes commands to download the stage-two malware from its command-and-control (C2) server, which is also called “Internal PDF Viewer.app”. Researchers noted that the malware is broken up into several stages to make any analysis more complicated, which is a common technique. The stage-two malware does not have an AppleScript file and has a different version, size, and bundle identifier data to appear more legitimate. The application is also signed by an ad-hoc signature. From the user perspective, a PDF viewing application is shown when the malicious application is launched, and the application is functional. A specific PDF must be loaded in the application for the malware to take next steps and communicate with the operators. Researchers described the PDF as a document that “shows a venture capital firm that is interested in investing in different tech startups” and noted that the PDF is likely the content from the website of a small but legitimate venture capital firm. The stage-three malware in this campaign is an ad-hoc signed trojan written in Rust that communicates with the C2 server for further instructions. CTIX analysts will provide updates regarding this campaign as they become available and will continue to monitor North Korean threat group activities. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.