Lateral Movement on macOS: Unique and Popular Techniques and In-the-Wild Examples

Summary

• A remote access tool, Apple Remote Desktop (ARD), is a legitimate application designed to manage and administer macOS devices within a network.
• It allows for remote administration, software distribution, asset management and other tasks, making it a powerful tool for system administrators.
• Attackers can use ARD to gain centralised control over multiple corporate machines, which could provide them with significant privileges and access to vital organizational resources.
• illegitimate use of Remote apple events
• (RAE), a feature in macOS, along with other native tools to perform lateral movement within a network, which could aid in evading detections.
• It is crucial to implement robust security defenses to prevent actors from leveraging these native tools to achieve malicious lateral movement and protect macOS environments from such threats. this article on [Palo Alto Networks](https://unit42.paloaltonetworks.com/ssh-key-theft-and-unauthorized-access/ and Apple Remote Desktop (ARD) for more details.

Original Article