New malware for mac called CloudMensis

[Xauma95]

Just wanted to know if we, MacOs users, are protected against CloudMensis with Malwarebytes?

Thanks in advance

[alvarnell]

Yes, detected as OSX.Generic.Suspicious since around the 20th of this month, if my notes are correct.

Edited July 26, 2022 by alvarnell

[treed]

It's detected as OSX.CloudMensis, actually, but yes, since the 20th. No detections so far, though, as is fairly typical with this kind of highly targeted malware. The average Mac user probably will never see this.

[alvarnell]

Perhaps it has been updated, but the CloudMensis LaunchDaemon (.com.apple.WindowServer.plist) was detected as OSX.Generic.Suspicious on the 20th.

Edit: Reran scan and it did pickup five of the six CloudMensis files I created and identified them as OSX.CloudMensis Malware. The one it missed was /Library/WebServer/share/httpd/manual/WindowServer, perhaps because it's not a threat.

The LauchDaemon is also still detected as OSX.Generic.Suspicious which must mean it matches an additional criteria that I hadn't considered.

As far as I've heard, the mechanism of delivery is still unknown, but was judged to be a limited, targeted attack.

Edited July 27, 2022 by alvarnell

[Xauma95]

Thank you guys for the answers

Edited July 27, 2022 by Xauma95

[treed]

13 hours ago, alvarnell said:

As far as I've heard, the mechanism of delivery is still unknown, but was judged to be a limited, targeted attack.

Yup, that's correct. There may even be some question about whether this particular variant is even still in circulation.

For a lot of these kinds of targeted attacks, we never see any detections. That could be because the attacker chooses not to target machines with antivirus, for fear of having their malware be discovered. It could also be because it's used to target people in Asia - which is the case with a fair bit of recent malware - where we have a very small user base. (In this case, we don't know who is being targeted.)

[treed]

13 hours ago, alvarnell said:

Perhaps it has been updated, but the CloudMensis LaunchDaemon (.com.apple.WindowServer.plist) was detected as OSX.Generic.Suspicious on the 20th.

Looking back at the details, I see that there is an old rule that would have detected this plist file as OSX.Generic.Suspicious. That one's been around for a while, so it would have detected this file a long time before we added more specific detections for CloudMensis.