CloudSyncD Propose Change

Actor(s): REF8801

According to Elastic Security Labs, CloudSyncD is a two-stage macOS backdoor written in C++ and distributed as a universal Mach-O binary covering both Apple Silicon and Intel slices, named after the daemon it masquerades as. The first stage presents an authorization dialog asking the victim for their account password, validates it against the local directory service, retains it, and uses it to launch the embedded second stage with administrative privileges while a decoy dialog reports a shared library version mismatch. The second stage, which its developer calls the gate, fingerprints the host by collecting the platform hardware identifier it uses as a victim id, the processor model and core count, physical memory, hardware model, kernel version, username, machine name and MAC address, then encrypts that report with ChaCha, Base64-encodes it and posts it to its command-and-control server. The server answers with a task carrying either a raw Mach-O executable or a gzip-compressed archive, which the implant checks, writes out as an anonymous or hidden file and runs with elevated privileges, falling back to a direct launch when elevation fails; strings in both stages are encrypted at compile time by an in-house cipher that XORs each byte against a shared table, a per-string seed and a position-dependent term.

References

There is no Yara-Signature yet.