New OS X spyware on the loose: Italy's Hacking Team is at it again
Mac security firm Intego has turned up a new version of the Remote Control System (RCS) Da Vinci rootkit, a pricey piece of dodgy spyware lawful intercept software sold to governments across the world by Italian security coders Hacking Team.
If Hacking Team’s handiwork sounds benign, Intego has given it the new and rather alarming-sounding name, ‘OSX/Crisis.B. The backdoor was first detected as ‘Crisis’ (officially called ‘Da Vinci’ by its makers) in the summer of 2012 when it was spotted targeting Moroccan journalists sympathetic to the Arab Spring.
Beyond the fact it targets Mac and Windows users and is littered with obviously Italian references (the dropper filename is named biglietta visita or ‘business card’), Crisis.B is currently hard to detect. The 47 antivirus engines it was tested against on VirusTotal returned a result of zero detections, Intego said.
