How Attackers Repurpose Existing Mac Malware

TL;DR

Attackers can repurpose existing Mac malware by reverse engineering its binary, redirecting its command-and-control connections, and building a compatible server for remote tasking. This approach lets them reuse tested capabilities while complicating attribution, but incomplete modification can expose operations or accidentally give the original malware operator access to newly infected targets.

Transcript

All right. It is 2:20, and, uh, with that, we're gonna go ahead and get started. It's my pleasure to introduce Patrick Wardle, who's a principal security, uh, researcher at Jamf. He's gonna talk to us about, uh, repurposed malware, a dark side of recycling. Uh, warm welcome to you, Patrick. Thank you. And the stage is yours. All right. Aloha, and w... Read More

Key Insights

• Repurposed malware is existing malicious software that has been reconfigured, often at the binary level, so a different operator can control and deploy it during offensive cyber operations.
• The main operational benefit is reuse of sophisticated, fully featured, and field-tested capabilities created by well-funded hackers, APT groups, or agencies with greater time, money, and technical resources.
• Attribution becomes less reliable when repurposed malware is detected because investigators may associate its recognizable code and behavior with the original author instead of the operator who captured, modified, and redeployed it.
• Repurposed malware can reduce operational exposure when an agency discovers another hacking group already occupying a target, since deploying another country's modified malware avoids installing the agency's primary implants in that risky environment.
• Reverse engineering is necessary because captured malware generally arrives without source code, requiring binary-level analysis of persistence, system interactions, remote communications, supported commands, and other local or remotely controlled capabilities.
• Command-and-control redirection works by locating server information embedded in the malware and patching the relevant bytes, such as through a hex editor, so the specimen connects to the new operator's infrastructure.
• A compatible command-and-control server is required when the malware expects remote tasking, and its operator must understand the specimen's communication protocol well enough to receive connections and issue supported commands.
• Incomplete repurposing creates serious risks because an overlooked backup server address may cause the modified malware to beacon to the original infrastructure when the replacement server becomes unavailable, potentially granting the original hacker access to new targets.

Questions & Answers

Q: What is repurposed malware?

Repurposed malware is a previously created malicious program that another operator captures, studies, and reconfigures for a new offensive operation. The modification often occurs directly at the binary level because source code is unavailable. A common objective is to replace the original command-and-control destination so the specimen receives instructions from the new operator's server instead of its creator's infrastructure.

Q: Why do attackers reuse existing Mac malware?

Attackers reuse existing Mac malware to obtain sophisticated, fully featured, and previously tested capabilities without performing all development work themselves. Well-funded hackers, APT groups, and agencies may have already invested substantial time, money, and resources in the specimen. Repurposing lets another operator adopt those capabilities for a separate mission after analyzing and modifying the captured binary.

Q: How does repurposed malware complicate attribution?

Repurposed malware complicates attribution because the underlying specimen retains code and characteristics associated with its original creator. If investigators detect the modified sample, they may attribute the activity to the hacker, APT group, or country that first developed it instead of the operator who later reconfigured and deployed it. This uncertainty is especially appealing to agencies seeking to conceal their activities.

Q: How do attackers choose malware to repurpose?

Attackers choose a specimen primarily according to the capability they need and the attribution they want investigators to infer. The desired payload might be an interactive backdoor, ransomware, a cryptocurrency miner, or another form of malware. An operator may also prefer a sample associated with a particular intelligence agency or hacker group because detection could redirect suspicion toward that original source.

Q: What must be analyzed before Mac malware is modified?

Before modification, analysts must develop a comprehensive understanding of the malware's local and remote behavior. They need to identify persistence mechanisms, system interactions, supported capabilities, command-and-control addresses, and the logic governing network communication. If the malware accepts remote tasks, analysts must also understand its protocol and catalog its supported commands so a replacement server can communicate with it correctly.

Q: How is a malware command-and-control address changed?

A command-and-control address can be changed by locating the address inside the malware binary and patching the corresponding bytes. When the address is embedded directly, the operator can open the specimen in a hex editor and replace it with the location of a new server. Afterward, testing in a virtual machine can confirm that the modified specimen connects to the replacement infrastructure.

Q: Why does repurposed malware need a custom command-and-control server?

A custom command-and-control server is necessary when the repurposed malware expects to connect remotely and receive tasks. Redirecting the binary alone does not provide control unless the new server can speak the malware's protocol and issue commands it supports. A Python script may be sufficient for analysis, while deployment to many targets would likely require a more robust and comprehensive implementation.

Q: What can go wrong when malware is incompletely repurposed?

Incomplete repurposing can leave original infrastructure embedded in the specimen. For example, an operator might replace the primary command-and-control address but overlook backup server addresses. If the new primary server becomes unavailable, the malware may beacon to the original hacker's servers. That mistake can expose the operation and potentially give the original hacker access to targets infected by the modified specimen.

Summary & Key Takeaways

• Repurposing malware means capturing an existing specimen, analyzing its behavior, and reconfiguring it for another operator's purposes. A modified sample can be redirected from its original command-and-control infrastructure to a new server, allowing the second operator to use capabilities developed and tested by a better-resourced hacker, agency, or APT group.

• The process begins by selecting malware according to its desired capability and possible attribution value. Analysts must reverse engineer the binary without source code, identify persistence and system interactions, locate every remote server address, understand the communication protocol, catalog remotely supported commands, and then patch the relevant binary data carefully.

• A repurposed specimen must be tested against operational and detection risks. Missing a backup command-and-control address could cause the malware to reconnect with its original operator, potentially exposing new targets. Because the starting specimen is usually known malware, the new operator must also consider detections created by Apple and third-party security products.