Researchers detected a new BitPaymer ransomware campaign that exploited an Apple zero-day vulnerability to target Windows users.

In August 2019, according to Morphisec, threat actors began using a new evasion technique to target an automotive organization with BitPaymer ransomware. This tactic consisted of exploiting a zero-day vulnerability in the Apple Software Update utility that’s packaged together with iTunes on Windows computers.

Specifically, they abused an unquoted path vulnerability that other vendors have identified over the past 15 years. Security researchers have typically spoken of this flaw in terms of privilege escalation, since it usually exists within a service like the Apple Software Update utility that has administrative execution rights.

By exploiting this vulnerability, the attackers helped their campaign evade detection in two important ways. First, they leveraged a signed and known program to execute a malicious child process, meaning that any security alert would have lower confidence than if they had leveraged Apple Software Update. The malicious “Program” file also didn’t come with an extension like .EXE, which means antivirus companies won’t generally scan those files.

BitPaymer’s Recent Attack Activity

In April 2019, Trend Micro observed an attack that leveraged an account with administrative privileges to target a U.S. manufacturing company with BitPaymer via PSExec.

Then, in July, Morphisec revealed that the ransomware had begun leveraging a new custom packer framework to target at least 15 U.S. organizations in both the public and private sectors.

Just a few days later, CrowdStrike identified an apparent fork in the ransomware family’s development when researchers found a new ransomware called DoppelPaymer using most of BitPaymer’s source code.

Secure Your Environment Against a Zero-Day Vulnerability

Security professionals can help defend against a zero-day vulnerability by adopting a vulnerability management program that combines strong perimeter protection and system hardening. Organizations should also consider investing in a comprehensive vulnerability management solution that integrates with their security information and event management (SIEM), network monitoring and other solutions.

More from

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Deploying Security Automation to Your Endpoints

Globally, data is growing at an exponential rate. Due to factors like information explosion and the rising interconnectivity of endpoints, data growth will only become a more pressing issue. This enormous influx of data will invariably affect security teams. Faced with an enormous amount of data to sift through, analysts are feeling the crunch. Subsequently, alert fatigue is already a problem for analysts overwhelmed with security tasks. With the continued shortage of qualified staff, organizations are looking for automation to…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…