RShell Malware Targets MacOS Users
RShell is the name of a piece of malware that is attributed to a Chinese advanced persistent threat actor known by several aliases, most notably APT27 and LuckyMouse.
RShell was discovered by a research team with SEKOIA and linked to a Chinese language app called MiMi, which has been "trojanized" since late May 2022 and was used to download and deploy the RShell malware.
According to SEKOIA, this is the first time LuckyMouse has been spotted targeting MacOS systems. The MiMi application versions starting from the update dated May 26, 2022 have a JavaScript code insert at the start of their module.exports function.
The JavaScript chunk of code is used to check if the environment is MacOS and if it is, the script downloads RShell from an IP address that is associated with the C2 infrastructure of the LuckyMouse APT.
Once executed, RShell attempts to contact its C2 server and sends kernel info, hostname, IP address and username of the host system.
The RShell malware accepts a number of commands that include file and directory enumeration, reading files, writing data to files, and deleting and closing files.
The links between LuckyMouse and RShell are the IP ranges used by both, as well as the fact that LuckyMouse has used trojanized and weaponized messaging applications in the past, similar to the MiMi messaging app.
