Yet another OSX/Java Trojan spotted in the wild
Hard on the heels of the Flashback Trojan, Kaspersky Labs is warning of a new OSX threat, which it’s dubbed Backdoor.OSX.SabPub.a.
In a post to Securelist, Kaspersky’s Costin Raiu says the Trojan connects to a command and control server hosted on a Californian-based VPS associated with the Onedumb.com free DNS.
Apparently a month old, the Trojan uses a Java exploit given the name Exploit.Java.CVE-2012-0507.bf in the Kaspersky post, with the ZelixKlassMaster obfuscator to try and get past malware detection products. Although Raiu says the infection vector is “not clear”, he said there are reports suggesting the Trojan is spread via e-mails directing users to URLs hosting the malware (located in the USA and Germany).
