{"id":5007,"date":"2012-06-29T18:08:12","date_gmt":"2012-06-30T01:08:12","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=5007"},"modified":"2024-07-29T11:56:51","modified_gmt":"2024-07-29T18:56:51","slug":"new-tibet-variant-found","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-tibet-variant-found\/","title":{"rendered":"New Tibet Variant Found"},"content":{"rendered":"

There is currently a new variant of the Tibet family of malware making the rounds. This is an attack that targets Uyghur<\/a> Mac users.<\/p>\n

The attack arrives in an email with a zip file called \u201cmatiriyal.zip\u201d that contains an image file and an OS X application file. The application is a new variant of the Tibet family of malware, which creates a backdoor that allows a remote attacker to view and access files on the computer as well as running commands.<\/p>\n

The previous variant, Tibet.C<\/a>, used an already-patched MS Office exploit<\/a>, which was detected by Intego as W97\/CodeExec.gen. The latest variant does not contain an exploit, but relies on the user \u2018s curiosity to make them choose to run the file.<\/p>\n

If the application is run, no user interaction required. It will be installed without requesting a password.<\/p>\n

Intego VirusBarrier<\/a>\u00a0with current malware definitions protects against this malware as OSX\/Tibet.C. While this malware is being found in the wild, the threat is currently low.<\/p>\n","protected":false},"excerpt":{"rendered":"

There is a new variant of the Tibet family of malware that is currently making the rounds. This is an attack that targets Uyghur Mac users. <\/p>\n","protected":false},"author":6,"featured_media":8763,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[190,13],"tags":[30,86,297,2773],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n