{"id":17603,"date":"2013-09-10T09:56:59","date_gmt":"2013-09-10T16:56:59","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=17603"},"modified":"2026-07-01T13:57:54","modified_gmt":"2026-07-01T20:57:54","slug":"os-x-malware-tibet-variant-found","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/os-x-malware-tibet-variant-found\/","title":{"rendered":"New OS X Malware: Another Tibet Variant Found"},"content":{"rendered":"

Things have been relatively quiet lately from the authors of the Tibet family of malware, but another variant was found last night on the Virus Total website, which is a site used by security researchers to share malware samples. Before last night, the last variant was found just over a year ago, and was already detected by Intego VirusBarrier’s existing virus definitions as OSX\/Tibet.C<\/a>.<\/p>\n

This time, the attack arrives via a Java applet on a web site. This drops a Java archive with the backdoor and launches it without user interaction, by way of a Java vulnerability. When installed, it creates a backdoor to the affected computer, which allows an attacker to view and access files on the computer as well as running commands. The malware uses recently patched Java vulnerabilities<\/a> CVE-2013-2465<\/a> and CVE-2013-2471<\/a>. If you’ve not yet updated, now would be a great time to do so.<\/p>\n

The archive file has the following contents:<\/p>\n

\"TibetD\"<\/a><\/p>\n

The new Tibet malware variant creates the following files when installed:<\/p>\n