Proprietary 2017-10-19 · 0 days ·Backdoor, Remote Access, Credential Theft

Eltima downloads served Proton RAT

Eltima's official macOS downloads for Elmedia Player and Folx were replaced with Proton RAT wrappers. The malware stole secrets and left a backdoor.

Story

Eltima's public download path failed for one day in October 2017. Users who fetched Elmedia Player or Folx from the official site received macOS disk images wrapped around legitimate applications and OSX/Proton. The built-in automatic update path was not reported affected.

ESET confirmed the poisoned downloads on October 19, notified Eltima at 10:35 EDT, and saw the site serving clean packages again by 15:15 EDT. The malicious wrappers were signed with an Apple Developer ID issued to Clifton Grimm, not Eltima. Apple revoked that certificate.

The wrapper launched the real application as cover, then extracted and ran Proton. It asked for the administrator password through a fake authorization prompt, installed a LaunchAgent, and placed its updater under /Library/.rand/. The technique was direct: keep the user interface normal, then persist below it.

Proton was built to steal. Public analyses describe browser credentials and cookies, macOS keychain data, 1Password vaults, SSH private data, GnuPG files, VPN configurations, cryptocurrency wallets, host data, remote shell functions, file upload and download, and command execution. For infected Macs, reinstalling the operating system and rotating secrets were the practical recovery steps.

Affected Artifacts

Incident Context

Motive
Financial Gain Data Theft
Attribution
Group
Cause
Server Compromise
Transitive
No
Actor
Cybercriminal Gang

Indicators

External References

Source record: proprietary/eltima/meta.yaml