NOT LOST IN TRANSLATION: ROSETTA 2 ARTIFACTS IN MACOS INTRUSIONS

Summary from the TLDR InfoSec newsletter

Rosetta 2 technology creates AOT files on Apple Silicon Macs, essential for analyzing macOS intrusions, even if malware is erased. Mandiant found that sophisticated actors target cryptocurrency firms with x86-64 malware due to its wider compatibility and lenient execution policies compared to ARM64. These AOT files, stored in protected cache directories, can uncover critical intrusion evidence through timestamps, execution patterns, and binary features, even after deleting malicious files.