TF-MAL-osx.frostyferret
📛 Threat Title
Malware family: FrostyFerret
Description
ThreatFox malware family `osx.frostyferret`. Printable name: FrostyFerret.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
osx.frostyferret
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.frostyferret
IOC database
- Type
- domain
- Value
osx.frostyferret- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-osx.frostyferret
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.frostyferret
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:cybercory.com
The cybersecurity landscape continues to evolve, with nation-state actors increasingly targeting macOS systems. In a recent development, Apple has pushed updates to its on-device malware detection tool, XProtect, to block new variants of the DPRK-attributed "Ferret" malware family . Dubbed "FlexibleFerret," this latest iteration of macOS malware is linked to North Korea's ...
-
web:cybersecuritynews.com
Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.
-
web:hivepro.com
This attack exploits job seekers and developers, tricking them into installing malware disguised as legitimate applications. Apple recently updated its XProtect malware detection tool to block several known variants, including FRIENDLYFERRET, FROSTYFERRET_UI, and MULTI_FROSTYFERRET_CMDCODES.
-
web:imtr.net
The malware family is referred to as the **macOS Ferret family **. ## Activity Summary The actor has been deploying malware targeting macOS systems, utilizing deceptive installers. Recent activity includes the deployment of variants blocked by Apple's XProtect signature update: FROSTYFERRET\_UI, FRIENDLYFERRET\_SECD, and MULTI\_FROSTYFERRET ...
-
web:redskyalliance.org
Two weeks ago, Apple pushed a signature update to its on-device malware tool XProtect to block several variants of what it called the macOS Ferret family : FROSTYFERRET_UI, FRIENDLYFERRET_SECD, and MULTI_FROSTYFERRET_CMDCODES. This DPRK-attributed malware family was first described by researchers in December and further in early January and identified as part of the North Korean Contagious ...
-
web:www.enterprisesecuritytech.com
Apple has stepped up its cybersecurity defenses with a fresh update to its on-device malware detection tool, XProtect, aimed at blocking multiple variants of macOS-targeting malware linked to North Korea's state-sponsored hacking campaigns. The malware family , identified as Ferret, includes FROSTYFERRET_UI, FRIENDLYFERRET_SECD, and MULTI_FROSTYFERRET_CMDCODES. Security researchers first ...
-
web:www.fortinet.com
FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.
-
web:www.globalsecuritymag.com
Last week Apple pushed a signature update to its on-device malware tool XProtect to block several variants of what it called the macOS Ferret family : FROSTYFERRET_UI, FRIENDLYFERRET_SECD, and MULTI_FROSTYFERRET_CMDCODES.
-
web:www.sentinelone.com
Last week Apple pushed a signature update to its on-device malware tool XProtect to block several variants of what it called the macOS Ferret family : FROSTYFERRET_UI, FRIENDLYFERRET_SECD, and MULTI_FROSTYFERRET_CMDCODES. This DPRK-attributed malware family was first described by researchers in December and further in early January and identified as part of the North Korean Contagious Interview ...
-
web:x.com
This campaign employs malware from the macOS Ferret family , which Apple has started countering through its XProtect tool. Notable variants include FROSTYFERRET_UI, FRIENDLYFERRET_SECD, and MULTI_FROSTYFERRET_CMDCODES. Recently, new samples labeled as FlexibleFerret were discovered, which continue to evade detection by XProtect.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.