The Chinese linked cyberespionage group Iron Tiger, or APT27, was identified by researchers at Trend Micro as exploiting the installers of the instant messaging framework MiMi. The group compromised the servers of MiMi and has maintained persistent access since November 2021, when they began deploying malicious installers for Windows and macOS. APT27 uploaded a malicious MiMi installer for macOS to legitimate MiMi servers this June. The sample would fetch ‘rshell’, a macOS backdoor that can collect system information and send it to the Command and Control (C and C) server, as well as execute commands received from its operators and...