RShell Malware Targets MacOS Users
RShell is the name of a piece of malware that is attributed to a Chinese advanced persistent threat actor known by several aliases, most notably APT27 and LuckyMouse.
RShell was discovered by a research team with SEKOIA and linked to a Chinese language app called MiMi, which has been "trojanized" since late May 2022 and was used to download and deploy the RShell malware.
Once executed, RShell attempts to contact its C2 server and sends kernel info, hostname, IP address and username of the host system.
The RShell malware accepts a number of commands that include file and directory enumeration, reading files, writing data to files, and deleting and closing files.
The links between LuckyMouse and RShell are the IP ranges used by both, as well as the fact that LuckyMouse has used trojanized and weaponized messaging applications in the past, similar to the MiMi messaging app.