Storm Cloud on the Horizon: GIMMICK Malware Strikes at macOS
Summary: Volexity found an intrusion in late 2021 on a MacBook Pro running macOS 11.6 (Big Sur), traced through a system running frp (fast reverse proxy) and subsequent internal port scanning, and recovered a macOS variant of a malware implant it calls GIMMICK from memory and disk. GIMMICK is used in targeted attacks by Storm Cloud, a Chinese espionage actor known to attack organizations across Asia, and uses public cloud hosting such as Google Drive for command-and-control, communicating only on working days to blend in.
What you should know: The implant was customized to imitate an application the targeted user commonly launched, and its Google Drive C2 channel plus weekday-only beaconing is designed to slip past network monitoring - Apple pushed XProtect and MRT signatures to block and remove it on March 17, 2022, so an unpatched or unprotected Mac may still be carrying it.
Read the original at Volexity Blog ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026