Description of Campaign
Threat actors have been targeting the macOS with backdoor malware in recent espionage campaigns, targeting users in Asia, particularly China and Hong Kong. The SysJoker backdoor was discovered in 2021 and is a multi-platform malware written in C++ that targets Windows, Linux, and macOS systems. SysJoker has hardcoded Google Drive links that are used for C2 communication. DazzleSpy, seen as early as mid-2021, is a backdoor malware that has been delivered through watering hole attacks. Users visit legitimate-looking websites or compromised websites where threat actors can inject malicious scripts into vulnerable systems.

Our ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by SentinelOne and shared publicly.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.
 
Campaign IOC

Type	Value
SHA256	1A9A5C797777F37463B44DE2B49A7F95ABCA786DB3977DCDAC0F79DA739C08AC
SHA256	D0FEBDA3A3D2D68B0374C26784198DC4309DBE4A8978E44BB7584FD832C325F0
SHA256	F9AD42A9BD9ADE188E997845CAE1B0587BF496A35C3BFFACD20FEFE07860A348
IP-DST	142.250.199.14
IP-DST	36.4.104.0
DOMAIN	graphic-updater.com

Minimum Content Versions

Content Type	Version
V2 DAT (VirusScan Enterprise)	10246
V3 DAT (Endpoint Security)	4701

  
Detection Summary

IOC	Scanner	Detection
1A9A5C797777F37463B44DE2B49A7F95ABCA786DB3977DCDAC0F79DA739C08AC	AVEngine V2	OSX/SysJoker
	AVEngine V3	OSX/SysJoker
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
D0FEBDA3A3D2D68B0374C26784198DC4309DBE4A8978E44BB7584FD832C325F0	AVEngine V2	OSX/SysJoker
	AVEngine V3	OSX/SysJoker
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
F9AD42A9BD9ADE188E997845CAE1B0587BF496A35C3BFFACD20FEFE07860A348	AVEngine V2	Pup-generic.c
	AVEngine V3	Pup-generic.c
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

                                    
Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

VirusScan Enterprise - Access Protection Rules:
Host Intrusion Prevention: