James McQuiggan, security awareness advocate at KnowBe4 commented that it was not surprising that threat actors were exclusively targeting Mac devices. Consequently, there are many ransomware variants targeting macOS users such as Gopher, Petya, KeRanger, Patcher, and Mabouia. Malwarebytes for Mac also can protect mac devices from this ransomware variant, according to Reed.īecause most people consider Macs to be immune to malware compared to windows, Apple computers have become a lucrative target for cybercriminals who exploit macOS users’ false sense of security. Wardle created a macOS ransomware protection tool name RansomWhere that can detect ThiefQuest ransomware. Working together with the director of Mac & Mobile at Malwarebytes, Thomas Reed, and macOS security researcher at SentinelOne, Phil Stokes, the researchers are working to create a decryptor that would save Mac users from paying the ransom. The researchers advised any affected user to consider their files lost and avoid paying the ransom. Consequently, the researchers believe the demand for a ransom was a smokescreen to dupe desperate users into sending money without the hope of ever receiving the decryption keys. The researchers found that the ransomware operators did not have contact information or a method of tracking payments, thus unable to know which user paid the ransom. The security experts believe the macOS ransomware was initially designed as spyware and that the encryption module was later added. The macOS ransomware also steals files related to cryptocurrency wallet applications. The ransomware completes the process by installing a keylogger and a reverse shell to record the user’s keystrokes and execute custom commands.
However, Reed said that activity was still under investigation because Google Chrome overwrites those files once it discovered an external application had modified them. ThiefQuest also updates the Google Chrome update files allowing the ransomware to run whenever the files are executed.
0 kommentar(er)
