Objective-See unveils ransomWhere macOS defense

Researcher Patrick Wardle surveys OS X ransomware history (KeRanger, FileCoder, Gopher, Mabouia, GinX) and introduces ransomWhere, a heuristic tool detecting rapid file encryption by untrusted processes.

This Objective-See blog post is a research writeup rather than an active-threat advisory. It traces the evolution of macOS ransomware from early browser-locking scareware ('FBI ransomware', 2013) through non-functional PoCs (FileCoder, 2014) to functional proof-of-concept tools (Gopher, Mabouia, 2015) and the first real in-the-wild macOS ransomware, KeRanger, which trojanized the signed Transmission BitTorrent client in March 2016. The author also references GinX, a ransomware-as-a-service offering advertised on an underground marketplace with a Mac variant.

The bulk of the article details the author's methodology for building 'ransomWhere?', a generic ransomware detection tool for macOS. It evaluates several user-mode file I/O monitoring techniques (dtrace, fs_usage/kdebug, OpenBSM, FSEvents API, and direct /dev/fsevents access), settling on direct FSEvents access for efficiency and process attribution. It then describes using statistical tests (entropy, Chi-Square distribution, Monte Carlo pi approximation) to distinguish encrypted files from merely compressed ones, and a trust heuristic (Apple-signed binaries and pre-existing installed apps are trusted) to reduce false positives when flagging processes rapidly creating encrypted files.

No active campaign, vulnerability, or specific victim is reported here; this is defensive tooling research building on prior disclosures (KeRanger by Palo Alto Networks, FileCoder by Kaspersky, Gopher by Pedro Vilaca). Severity is low as the piece is informational/defensive research rather than a report of ongoing exploitation.

Source reporting: https://objective-see.org/blog/blog_0x0F.html