Lazarus APT Group Leverages Extended Attributes To Evade Detection

The Lazarus APT group has begun embedding malware known as RustyAttr into devices by hiding malicious code in custom extended file attributes. Developed with the Tauri framework RustyAttr was initially signed with a leaked certificate later revoked by Apple and remained unnotarized. As a result macOS Gatekeeper blocks these applications unless a user manually overrides security settings. It is unknown if any victims were affected before the certificate revocation.