CampaignPublished 10 Jul 2025

macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App

Source AlienVault OTX General

Description

A new variant of macOS.ZuRu malware has been discovered, targeting users through a trojanized version of the Termius app. This backdoor, initially noted in 2021, now uses a modified Khepri C2 framework for post-infection operations. The malware is delivered via a .dmg disk image containing a hacked version of Termius.app. It adds two executables to the embedded Termius Helper.app and uses a new method to trojanize legitimate applications. The malware installs persistence via a LaunchDaemon and includes an md5 updater mechanism. The payload obtained from the C2 is a modified Khepri beacon with capabilities for file transfer, system reconnaissance, and command execution. The threat actor continues to target developers and IT professionals, adapting their techniques to evade detection.

Impact

For European organizations, particularly those employing macOS devices in development, IT operations, or infrastructure management, this threat poses a substantial risk. The malware’s ability to establish persistence and execute arbitrary commands can lead to unauthorized access to sensitive systems, data exfiltration, and lateral movement within corporate networks. Developers and IT professionals are prime targets, meaning organizations with sizable technical teams using Termius or similar SSH clients are at elevated risk. Compromise could result in intellectual property theft, disruption of critical services, and potential exposure of confidential customer or business data. Additionally, the malware’s evasion techniques and updater mechanism complicate detection and remediation efforts, increasing dwell time and potential damage. The use of legitimate-looking applications as infection vectors may also undermine user trust and complicate incident response. Given the increasing adoption of macOS in enterprise environments across Europe, the threat could impact sectors such as finance, technology, telecommunications, and government agencies, where secure remote access tools are prevalent.

Defensive guidance

To mitigate this threat effectively, European organizations should implement a multi-layered defense strategy tailored to the specifics of this campaign: 1) Enforce strict application whitelisting policies to prevent execution of unauthorized or trojanized applications, especially for critical tools like SSH clients. 2) Verify the integrity and authenticity of software downloads by using official sources and validating digital signatures before installation. 3) Deploy endpoint detection and response (EDR) solutions with capabilities to detect anomalous LaunchDaemon creations, suspicious helper app modifications, and unusual network communications to known malicious domains. 4) Monitor network traffic for connections to the identified C2 domains (e.g., ctl01.macnavicat.com, ctl01.termius.fun) and block or alert on such communications. 5) Educate developers and IT staff on the risks of installing software from untrusted sources and encourage the use of managed software deployment tools. 6) Implement robust logging and monitoring of system processes and file changes, focusing on md5 hash changes indicative of updater mechanisms. 7) Regularly audit macOS systems for persistence mechanisms such as LaunchDaemons and unauthorized helper app modifications. 8) Employ network segmentation to limit the lateral movement potential of compromised endpoints. 9) Maintain up-to-date backups and incident response plans tailored to macOS environments to enable rapid recovery if infection occurs.

Indicators of compromise

Domains 4

ctl01.macnavicat.com
ctl01.termius.fun
download.finalshell.cc
download.termius.info

Hashes 4

a7a9b0f8cc1c89f5c195af74ce3add74733b15c0
ace81626924c34dfbcd9a485437cbb604e184426
de8aca685871ade8a75e4614ada219025e2d6fd7
fa9b89d4eb4d47d34f0f366750d55603813097c1

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Jul 2025, 18:46 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 4

Community reviews

Related threats