News and Analysis

Cybersecurity researchers from Group-IB have discovered a new piece of malware, dubbed RustyAttr, which was likely developed by North Korean state-sponsored actors. RustyAttr uses macOS files’ extended attributes to deploy its payload, a technique believed to be novel. Although there were no reported victims, researchers suggest the malware was an experiment to explore new delivery and obfuscation methods on macOS devices.