Google TAG watering hole drops OSX.CDDS implant
Google TAG uncovered a watering-hole campaign chaining a WebKit n-day and an XNU 0-day to deploy the OSX.CDDS macOS backdoor, now analyzed by Objective-See.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-1789 and CVE-2021-30869 as exploited in the wild.
Google's Threat Analysis Group published research on a highly targeted watering hole campaign that used both iOS and macOS exploit chains to infect Apple users. The macOS chain combined a patched WebKit RCE (CVE-2021-1789) with an XNU local privilege escalation zero-day (CVE-2021-30869), the latter reportedly first demonstrated publicly by Pangu Lab at zer0con21 and MOSEC conferences. Objective-See obtained sample hashes provided by Google and performed independent analysis of the payload, dubbed OSX.CDDS, which remained fully undetected by all AV engines on VirusTotal at time of analysis.
The implant exists in at least two variants: a 2019 sample distributed via a trojanized 'Flash Player' installer (social engineering, apparently targeting Chinese-speaking users based on embedded Chinese-language strings) and a 2021 sample delivered directly via the exploit chain. Both versions drop a persistent Launch Agent (com.UserAgent.va.plist) and install a toolkit into ~/Library/Preferences/Tools, including screen-capture and system-survey utilities, and — notably in the 2021 sample — a keylogger (kAgent) built on Core Graphics Event Taps. The implant communicates with its C2 using a Data Distribution Service (DDS) publish-subscribe framework and supports numerous tasking commands, indicating a fairly full-featured backdoor capability set.
Objective-See demonstrated that its free tools (BlockBlock, LuLu, KnockKnock) were able to detect the implant's persistence and C2 beaconing behavior without prior signatures. The overall architecture — separating exploit delivery from implant deployment — is consistent with more resourced threat actor tradecraft, though the article does not attribute the campaign to a specific named group.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Source reporting: https://objective-see.org/blog/blog_0x69.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs