RustDoor is a Rust-written backdoor for macOS that Bitdefender reported in February 2024. Its samples disguised themselves as Visual Studio updates and included code for both Intel and Apple silicon Macs. Bitdefender said infrastructure clues suggested a possible relationship with Black Basta and ALPHV/BlackCat, but explicitly said the evidence was not enough to confidently attribute the campaign to a specific actor.
What RustDoor is—and what the reports actually establish
Bitdefender identified the malware as Trojan.MAC.RustDoor.*, a backdoor written in Rust. It traced samples to November 2023 and said its freshest original sample was observed on February 2, 2024. The samples impersonated Visual Studio updates and were FAT binaries containing Mach-O files for Intel x86_64 and Arm processors. Bitdefender’s later update also described earlier first-stage downloaders disguised as fake job offers. These observations show lures and samples, but not a complete account of how every victim was initially compromised. Bitdefender’s RustDoor analysis
The analyzed samples were not identical. Bitdefender grouped them as Variant Zero, Variant 1, and Variant 2: Variant Zero lacked the embedded configuration and AppleScript found in later variants; Variant 1 appeared to be a test build; and Variant 2 contained a more complex JSON configuration and AppleScript used for exfiltration. Configuration options could specify collection limits, target folders and file extensions, impersonated applications, and customized fake administrator prompts. The options and behaviors described in the report should not be assumed to have been enabled in every sample.
What RustDoor could do on an affected Mac
Across the analyzed samples, Bitdefender documented support for remote shell and file-management operations, downloads and uploads, process-related commands, and displaying a dialog. The samples gathered machine information and communicated with command-and-control (C2) endpoints. The updated report also describes Go binaries that collected system and network details, as well as C2 endpoints that exposed victim and task information. These are reported capabilities and observations—not a guaranteed feature list for every RustDoor build.
Recommended Free Tools
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
File collection and exfiltration
One described AppleScript variant searched Desktop and Documents, read user Notes data, and selected files with extensions covering documents, images, archives, configuration files, keys, and remote-access files. It copied collected material into a hidden folder, compressed it as a ZIP archive, and sent it to C2. That account describes a particular observed variant, not proof that every sample stole every listed file type.
Persistence options
The embedded configuration described several ways a sample could seek to run again: creating cron jobs, installing a LaunchAgent that runs at login, modifying ~/.zshrc to execute on a new ZSH session, or adding the binary to the Dock. These were configurable options in Bitdefender’s analysis, not evidence that all four mechanisms were used on every infected Mac.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Is RustDoor linked to Black Basta or BlackCat?
Bitdefender’s wording was cautious: “While the current information about Trojan.MAC.RustDoor is not enough to confidently attribute this campaign to a specific threat actor, artifacts and IoCs suggest a possible relationship with the BlackBasta and (ALPHV/BlackCat) ransomware operators.” Its concrete infrastructure clue was that three of the four observed C2 servers had previously been associated with ransomware campaigns targeting Windows clients. That overlap supports a possible relationship; it does not prove that Black Basta or ALPHV/BlackCat operated RustDoor.
Why a later RustDoor report points to a separate campaign
Palo Alto Networks Unit 42 later described RustDoor samples in a separate campaign targeting software developers in the cryptocurrency sector. Unit 42 assessed with moderate confidence that this campaign was conducted on behalf of the North Korean regime. It did not resolve which North Korean group was responsible, or whether RustDoor was unique to one group. Its assessment drew on infrastructure, victimology, and tool-set evidence. This is a campaign-specific assessment; it neither settles the attribution of Bitdefender’s original samples nor establishes one actor behind RustDoor as a whole. Unit 42’s RustDoor campaign report
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How RustDoor may reach a Mac—and what remains unknown
The Visual Studio update disguise, fake administrator prompts, and earlier fake-job-offer downloaders show how the malware could be presented to a target. They do not establish the full initial access chain. The UAE Cyber Security Council advisory states that “the exact initial access pathway used to propagate the implant is currently unknown.” A familiar product name or realistic update window is not proof that software came from its legitimate publisher. UAE Cyber Security Council advisory
What to do if you downloaded a fake Visual Studio update
If you suspect you ran a fake installer, treat the Mac as potentially compromised. A suspicious prompt requesting an administrator password during an unexpected installation deserves particular scrutiny.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Stop interacting with the installer. Do not enter credentials into a prompt you cannot verify. If the installer is still running, disconnect the Mac from the network while you seek trusted help.
- Contact your organization’s IT or security team if this is a work device. Preserve the file, message, or download details for responders rather than deleting evidence or attempting an improvised cleanup.
- Change potentially exposed passwords from a separate, trusted device. Prioritize accounts whose credentials may have been entered on the Mac, and enable multifactor authentication where available.
- Have the Mac assessed and cleaned using reputable security tools or professional incident response. A scan can help, but it is not a guarantee that the backdoor or persistence mechanisms have been removed.
- Install macOS and software updates from trusted sources after the incident has been assessed. Obtain applications and updates through the publisher’s legitimate distribution channel, not an unexpected link or prompt.
The UAE Cyber Security Council also recommends blocking the advisory’s indicators of compromise, using reputable anti-malware and current threat intelligence, avoiding untrusted software and suspicious messages, applying patches including macOS updates, and using strong passwords with MFA. These measures reduce risk but cannot guarantee prevention.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Is RustDoor still active?
The cited reporting establishes samples traced to late 2023 and activity reported in 2024, including Unit 42’s later separate campaign. Those sources do not establish whether RustDoor remains active on October 4, 2026. Without newer reporting, a present-day claim that the malware is active—or inactive—would go beyond the available evidence.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
