New Rust-Based macOS Backdoor Steals Files, Linked to Ransomware Groups

**Trojan.MAC.RustDoor** is a Rust-based macOS backdoor active since November 2023 that impersonates Visual Studio updates to deploy FAT binaries for x86_64 and ARM, supports remote commands (ps, shell, upload, download, etc.), exfiltrates specific user documents and notes, uses multiple persistence mechanisms (LaunchAgents, cron, Dock, zshrc), and communicates with C2 endpoints; artefacts and IoCs indicate a possible link to BlackBasta/ALPHV ransomware operators.