Mac espionage trojan targets Uighur activists

Share this article:

Researchers at Kaspersky Lab said Friday that they have come across a new "advanced persistent threat (APT)" campaign targeting Uighur activists who use Mac OS X.

The backdoor, dubbed MaControl.b, is being used to spy on Uighur dissidents. On Wednesday, researchers said they discovered the "new wave" of APT attacks targeting the Turkik-speaking Muslim group, which mostly lives in the northwest Chinese province of Xinjiang.

The attackers are sending their prospective victims legitimate looking emails that contain a difficult-to-detect exploit disguised in a ZIP file, which is attached.

"When executed, it installs itself in the system and connects to its command-and-control server to get instructions," wrote Costin Raiu, a senior security researcher at Kaspersky, in a blog post. "The backdoor allows its operator to list files, transfer files and generally run commands on the infected machine."

The Uighurs have sought greater religious freedoms and autonomy, and have staged a number of uprisings against Chinese rule. The U.S. State Department has called out the Chinese government for repressing and committing human rights abuses against the minority group.

This is not the first time this year that virus authors have customized their wares to run on the Mac and go after dissidents. In March, the security firm AlienVault reported that Tibetan activists were being targeted by remote access trojans, or RATs, which took advantage of a three-year-old vulnerability in Microsoft word.

"With Macs growing in popularity and their increased adoption by high-profile targets, we expect the number of Mac OS X APT attacks will also grow," Raiu wrote.

In fact, his blog post includes a photo of the Dalai Lama using a 17-inch MacBook Pro during a meeting.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Court shutters NY co. selling security software with "no value"

A federal court shut down Pairsys at the request of the Federal Trade Commission.

Franchises to get assistance on cybersecurity strategy

The National Cyber Security Alliance has teamed up with the International Franchise Association to promote cybersecurity awareness among franchise businesses in the U.S.

Bulgarian national sentenced 30 months for role in ID theft ring

Aleksi Kolarov was a vendor on Shadowcrew.com, an online cybercrime marketplace that sold stolen credit and bank cards and caused millions of dollars in damages.