By 
The North Korean-backed BlueNorOff threat group targets Apple customers with a new macOS malware strain dubbed ObjCShellz that can open remote shells on compromised devices.
BlueNorOff is a financially motivated hacking group known for attacking cryptocurrency exchanges and financial organizations such as venture capital firms and banks worldwide.
Jamf Threat Labs, which disclosed details of the malware, said it is used as part of the RustBucket malware campaign, which came to light earlier this year.
In this campaign, the actor reaches out to a target claiming to be interested in partnering with or offering them something beneficial under the guise of an investor or head hunter. BlueNorOff often creates a domain that looks like it belongs to a legitimate crypto company in order to blend in with network activity.
The researchers have yet to determine which were the victims of the ObjCShellz attacks, however, the choice of using a domain similar to the one of a legitimate exchange suggests that threat actors targeted an entity or an individual with an interest in the crypto currency sector.
ObjCShellz is written in Objective-C, it is a remote shell that allows attackers to execute commands on the infected systems. According to the experts, the malware is likely being used at a later stage to manually run commands after compromising a system.
This malware is still very functional and will help attackers carry out their objectives.
North Korea-linked threat actors continue to target organizations in the cryptocurrency industry to circumvent international sanctions and finance its military operations.
Recently Elastic Security Labs reported that North Korea-linked Lazarus APT group was spotted using new KandyKorn macOS malware in attacks against blockchain engineers.
