RustBucket is macOS malware that Jamf Threat Labs reported in April 2023 and suspects is North Korean; it starts with an unsigned app named Internal PDF Viewer that only acts when you open a specially crafted PDF in it. Legitimate PDFs open in Preview, so delete any 'special PDF viewer' someone sent you, and get professional help if you opened one.
Last reviewed · 1 source
Also known as: REF9135, BlueNoroff RustBucket
Jamf Threat Labs described RustBucket in April 2023 and suspects a North Korean state-sponsored actor; others attribute it to BlueNoroff, a part of the Lazarus Group focused on financial theft. The first stage is an unsigned app, Internal PDF Viewer.app, with an AppleScript inside. It really works as a basic PDF viewer, and the attack only moves on when the victim opens a specific rigged PDF, which unlocks a later stage that lets the attackers gather system information and run commands. Jamf saw no way for the app to run without the user manually overriding Gatekeeper.
Messages with a PDF you're told needs a special viewer
An unsigned viewer app, Internal PDF Viewer.app, that you have to override Gatekeeper to open
A rigged PDF that triggers the next stage only inside that viewer
You received a PDF that came with its own viewer app
An app named Internal PDF Viewer, or similar, in /Applications or Downloads
You had to override a Gatekeeper warning to open a document viewer
Disconnect from all networks. RustBucket is built for targeted, persistent access, so assume the attacker may still have a way in.
Delete Internal PDF Viewer or any similar PDF app you were sent, and the PDF that came with it.
Look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for plist files created at the same time, and in Login Items.
Review which files, accounts and systems were reachable from this Mac, and rotate credentials accordingly.
CoreLock's free scan checks startup items and compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. It can't promise to find every RustBucket component, so consider professional incident response.
Open PDFs in Preview; a legitimate PDF never needs a special viewer
Don't override Gatekeeper for apps someone sent you
Confirm a sender through a separate channel before opening an attachment
Be most careful if you work in finance or crypto, the usual targets of this group
What it can and can't do
The fake viewer and its PDF usually sit in your Downloads folder, which CoreLock's free Downloads check compares against a built-in malware-hash list and 19 YARA rules, and its startup-items check covers launch items. State-sponsored malware can go beyond what any consumer scan finds, and CoreLock can't promise to catch every variant.
Trojan — Lazarus Group is a North Korean state-sponsored group attributed to the Reconnai...
Trojan — Silver Sparrow is an activity cluster Red Canary reported in February 2021. Its ...
Trojan — Trend Micro described XCSSET in August 2020: it inserts code into local Xcode pr...
A multi-stage macOS backdoor reported by Jamf Threat Labs in April 2023. A working but malicious PDF viewer waits for a specific rigged PDF, which unlocks a later stage that lets attackers gather information and run commands on the Mac.
The name comes from parts of the malware being written in Rust, a programming language.
It was used in targeted attacks, and it only works if you open an unsigned app someone sent you and override Gatekeeper's warning. Declining that is the whole defense.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser