Nowadays, many products are advertised as cross-platform, and malware is no exception. Our most common malware usually targets a single operating system. However, the new backdoor malware that appeared this time is very special and can be said to break our previous impressions. This one, named “SysJoker”, is the latest cross-platform malware discovered and can affect Windows, macOS and Linux systems.
New “trinity” backdoor malware emerges, affecting Windows, macOS and Linux
Although there are a lot of malware targeting Windows systems, malware that can actually attack on three different platforms: Windows, macOS, and Linux is very rare. In December 2021, Intezer security researchers first discovered this malware and named it “SysJoker”. From a certain perspective, SysJoker is more cunning on two platforms other than Windows, and VirusTotal cannot detect the signs of malware on Linux and macOS.
▲Using VirusTotal on an already infected M1 version of Mac cannot detect SysJoker
SysJoker’s attack uses the familiar “backdoor” approach, providing attackers who exploit it with a secret espionage tool that can covertly penetrate the system and control all operations on it. Intezel deduced that SysJoker should be the product of an Advanced Threat Actor, and hinted at the risk of potential ransomware. In the unit’s report, it wrote: “Based on the capabilities of the malware,” we assess that the target of the attack is espionage and horizontal spread, and it is likely that ransomware will be deployed as the next stage of the attack. “
SysJoker masquerades as a system update and generates its C2 by decoding strings retrieved from file archives hosted on Google Drive. During Intezer’s analysis, the C2 changed three times, indicating that the attacker is active and monitoring infected computers. Based on the behavior of the victim and malware, it can be inferred that SysJoker may be pursuing a specific target. SysJoker has been uploaded to VirusTotal with the .ts suffix for TypeScript files. This malware is likely to be distributed through infected npm packages. The following figure shows the communication process between SysJoker and C2:
This malware was rewritten from scratch and is not a variant of other malware. Its details have not been seen in previous attacks, and almost no malware targeting Linux has been found in the past. The attacker registered at least 4 different domains and wrote them from scratch for Windows, macOS and Linux. The meticulous thinking and novel techniques are worth observing. During the entire analysis process, Intezer did not find that the attacker sent a second-stage attack or instructions, which indicates that the attack has a specific target and specific operator, and most likely an Advanced Threat Actor will perform the next step.
Source: KOCPC Chinese