Threat video1:00
BeaverTail Native macOS Qt Variant: Detection & IOCs
Native Qt/C++ BeaverTail steals browser, wallet and keychain data through a fake MiroTalk app: 9 detection rules, 26 IOCs and a free Splunk SPL rule.
Read the full threat intel for BeaverTail Native macOS Qt Variant: Detection & IOCs →
Chapters
- 0:00The hookA fake conference app targets six wallet extensions.
- 0:04The storyFake jobs tricked victims to download it.
- 0:11Attack pathVictims ran the fake app.
- 0:26AttributionAttributed to Contagious Interview.
- 0:31Indicators of compromise24 indicators to hunt: 1 IP, 1 domain and 6 URLs, and more.
- 0:38MITRE ATT&CK techniques14 ATT&CK techniques, from initial access to impact.
- 0:43Remediation9 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A fake conference app targets six wallet extensions.
0:05Fake jobs tricked victims to download it.
0:07It stole wallet and browser data.
0:11Victims ran the fake app.
0:13It targeted Chrome and Brave for wallet data.
0:16Stolen data reached a DPRK command server.
0:19Then it installed a Python backdoor.
0:21It drained cryptocurrency accounts.
0:26Attributed to Contagious Interview. Confidence: medium.
0:3124 indicators to hunt: 1 IP, 1 domain and 6 URLs, and more.
0:3814 ATT&CK techniques, from initial access to impact.
0:439 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.