{"id":26330,"date":"2021-07-07T16:31:06","date_gmt":"2021-07-07T13:31:06","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=26330"},"modified":"2026-03-27T22:49:34","modified_gmt":"2026-03-27T19:49:34","slug":"wildpressures-multi-platform-malware-hits-macos-in-the-middle-east","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/wildpressures-multi-platform-malware-hits-macos-in-the-middle-east\/","title":{"rendered":"WildPressure\u2019s multi-platform malware hits macOS in the Middle East"},"content":{"rendered":"\n

Kaspersky has been tracking Milum\u2014a malicious Trojan used by WildPressure, an advanced persistent threat (APT) actor active in the Middle East\u2014<\/strong>since August 2019<\/strong><\/a>. While investigating one of the latest attacks by the actor on what seems to be the industrial sector, Kaspersky researchers discovered newer versions of the malware written in different programming languages. One of the versions is able to infect and run on both Windows and macOS systems.<\/strong><\/p>\n\n\n\n

In threat hunting, many discoveries unravel from a small clue, and this campaign is no exception. Often, once a device is infected by a Trojan, the malware sends a beacon to the attackers\u2019 servers, which contains information about the device, network settings, user name and other relevant information. This helps the attackers determine whether an infected device is of any interest. However, in the case of Milum, it also sent information about the programming language in which it was written. When first investigating the campaign in 2020, Kaspersky researchers suspected that this pointed to the existence of different versions of this Trojan in different languages. Now this theory has been confirmed.<\/p>\n\n\n\n

In spring 2021, Kaspersky identified a new attack by WildPressure, which was carried out with a set of newer versions of the Milum malware. The files discovered contained the Milum Trojan written in C++ and a corresponding Visual Basic Script (VBScript) variant. Further investigation into this attack uncovered another version of the malware written in Python, which was developed for both Windows and macOS operating systems. All three versions of the Trojan were able to download and execute commands from the operator, collect information, and upgrade themselves to a newer version.<\/p>\n\n\n\n

Multi-platform malware capable of infecting devices that run on macOS is rare. This particular specimen was delivered in a package, which included the malware, Python library, and a script named \u2018Guard\u2019. This enabled the malware to launch both on Windows and macOS with little additional efforts. Once infecting the device, the malware runs operating system-dependent code for persistence and data gathering. On Windows, the script is bundled into an executable with a PyInstaller. The Python Trojan is also capable of checking whether security solutions are being run on a device.<\/p>\n\n\n\n

\u201cWildPressure operators retain their interest in the same geographical area. Malware authors developed multiple versions of similar Trojans, and they have a versioning system for them. The reason behind the development of similar malware in multiple languages is most probably <\/em>to decrease the likelihood of detection. This strategy is not unique among APT actors, but we rarely see malware that is adapted to run on two systems at once, even in the form of a Python script. Another curious feature is that one of the targeted operating systems is macOS, which is a surprising target given the geographical interest of the actor\u201d,\u00a0comments Denis Legezo,\u00a0a senior security researcher at GReAT, Kaspersky.<\/p>\n\n\n\n

To avoid becoming a victim of a targeted attack, Kaspersky experts recommend:<\/h3>\n\n\n\n