Threat actors intending to attack Apple macOS systems are likely to pay attention to Geacon, a Cobalt Strike implementation written in the Go programming language.
The details were accumulated by SentinelOne, which noticed an increase in the quantity of Geacon payloads that have been showing up on VirusTotal lately.
"While some of these are likely red-team operations, others bear the characteristics of genuine malicious attacks," security researchers Phil Stokes and Dinesh Devadoss explained in a report.
Red teaming and adversary simulation tool Cobalt Strike was created by Fortra and is well recognised. Illegally cracked versions of the software have been abused by threat actors throughout the years due to its numerous post-exploitation features.
While Cobalt Strike's post-exploitation activities mostly targeted Windows, assaults against macOS are rather uncommon.
A malicious Python package called "pymafka" was created to install a Cobalt Strike Beacon on infected Windows, macOS, and Linux computers. Sonatype, a software supply chain company, revealed details of this package in May 2022.
The discovery of Geacon artefacts in the wild, however, could alter that. Since February 2020, GitHub has hosted Geacon, a Go version of Cobalt Strike.
Additional investigation into two fresh VirusTotal samples posted in April 2023 has linked them to two Geacon versions (geacon_plus and geacon_pro) created in late October by two unidentified Chinese developers, z3ratu1 and H4de5.
The geacon_pro project is no longer available on GitHub, but a snapshot from the Internet Archive on March 6, 2023 shows that it can get past antivirus programmes including Microsoft Defender, Kaspersky, and Qihoo 360 360 Core Crystal.
While geacon_plus supports CobaltStrike versions 4.0 and after, the tool's creator, H4de5, asserts that geacon_pro is primarily meant to handle CobaltStrike versions 4.1 and later. The software is currently at version 4.8.
One of the artefacts found by SentinelOne, Resume_20230320.app by Xu Yiqing, uses a run-only AppleScript to connect to a remote server and download a Geacon payload. Both Apple silicon and Intel architectures are compatible with it.
"The unsigned Geacon payload is retrieved from an IP address in China," the researchers explained. "Before it begins its beaconing activity, the user is presented with a two-page decoy document embedded in the Geacon binary. A PDF is opened displaying a resume for an individual named 'Xu Yiqing.'"
The Geacon binary, created by compiling the geacon_plus source code, includes a wide range of features that enable it to download next-stage payloads, exfiltrate data, and improve network connections.
The second copy is reportedly included into a trojanized app that poses as the SecureLink remote assistance app (SecureLink.app) and primarily targets Intel devices, according to the cybersecurity firm.
The basic, unsigned programme asks users for permission to access contacts, pictures, reminders, as well as the camera and microphone on the smartphone. The Geacon payload from the geacon_pro project, which connects to a known command-and-control (C2) server in Japan, is the core element of the attack.
