Researchers have discovered a new variant of the “RustBucket” malware that is currently targeting Apple macOS users. The RustBucket malware family has been previously attributed to BlueNoroff, a North Korean subgroup of the Lazarus Group, and was first identified in April 2023. The variant, described as the “first instance of BlueNoroff malware specifically targeting macOS users,” is known as a second-stage malware that compiles in Swift and, as of June 29, 2023, has zero (0) detections on VirusTotal, a malware analyzing tool. The RustBucket variant has a persistence capability that is new to the RustBucket malware family, where it establishes its own persistence by adding a “plist” file at a specific path and copies its binary to an additional path. The malware is also currently “leveraging a dynamic network infrastructure methodology” for its command-and-control (C2) abilities. The variant dynamically generates a 16-byte ransom value at runtime, which serves as an identifier for the specific malware instance and gathers system information. Once a connection is established with a C2 server, one (1) of two (2) commands are returned to the malware. The first command directs the malware to self-terminate. The second command enables the operator to upload and execute malicious binaries or scripts within the infected machine. Researchers described the victim of the latest RustBucket activity as “a venture-backed cryptocurrency company providing services to businesses such as payroll and business-to-business transactions with a headquarters in the European Union.” RustBucket is currently in active development and CTIX analysts will continue to monitor its evolution. Technical details and indicators of compromise (IOCs) can be viewed in the report linked below.