Site of BitTorrent App "Transmission" Again Used to Deliver OS X Malware

The security firm ESET warned last month that a new Mac OS X malware started doing the rounds. The threat, dubbed OSX/Keydnap, is capable of stealing the content of the OS X keychain and maintaining a permanent backdoor on the infected system.
 
At the time, researchers were uncertain how Keydnap had been distributed, but they suspected that cybercriminals used spam messages and downloads from untrusted websites. In reality, it turns out that the malware has also been distributed from a legitimate website.
 
According to ESET, cybercriminals compromised the official Transmission site and replaced the legitimate application with a malicious version. Experts believe the malware was available for download as Transmission v2.92 between August 28 and August 29.
 
Users who downloaded the app in this timeframe can determine if they are infected by checking if certain files associated with the malware can be found on their system. Indicators of compromise (IoC) are available on ESET's website.
 
This was not the first time Mac malware had been served from the Transmission website. In March, Palo Alto Networks warned that a piece of ransomware dubbed KeRanger, which is believed to be based on Linux.Encoder, was delivered via the official Transmission installer.
 
ESET has found several similarities between KeRanger and Keydnap, such as the fact that both malicious apps were signed with legitimate code-signing certificates that allowed them to bypass Apple’s Gatekeeper feature. Researchers also noticed similarities in the code, including the path and parameter used for the command and control (C&C) URL resource.
 
The version of Keydnap delivered via the Transmission website is version 1.5. Compared to the version analyzed by ESET last month, it includes a standalone Tor client that allows it to reach its C&C server over the Tor network without needing a separate Tor2Web relay. It also includes a new command that allows cybercriminals to set a different URL for the C&C server.

---