Mac espionage trojan targets Uighur activists

Powered by SC Magazine
 

The Uighur Muslim minority group is subject to a sophisticated attack.

Researchers at Kaspersky Lab have come across a new malware campaign targeting Uighur activists who use Mac OS X.

The backdoor, dubbed MaControl.b, is being used to spy on Uighur dissidents. Researchers said they discovered the "new wave" of advanced persistent threat attacks targeting the Turkik-speaking Muslim group, which mostly lives in the northwest Chinese province of Xinjiang.

The attackers are sending their prospective victims legitimate looking emails that contain a difficult-to-detect exploit disguised in a ZIP file, which is attached.

"When executed, it installs itself in the system and connects to its command-and-control server to get instructions," said Kaspersky senior security researcher Costin Raiu. "The backdoor allows its operator to list files, transfer files and generally run commands on the infected machine."

The Uighurs have sought greater religious freedoms and autonomy, and have staged a number of uprisings against Chinese rule. The US State Department has called out the Chinese government for repressing and committing human rights abuses against the minority group.

This is not the first time this year that virus authors have customised their wares to run on the Mac and go after dissidents. In March, the security firm AlienVault reported that Tibetan activists were being targeted by remote access trojans, or RATs, which took advantage of a three-year-old vulnerability in Microsoft word.

"With Macs growing in popularity and their increased adoption by high-profile targets, we expect the number of Mac OS X APT attacks will also grow," Raiu wrote.

In fact, his blog post includes a photo of the Dalai Lama using a 17-inch MacBook Pro during a meeting.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1069

Vote