Objective-See unveils ransomWhere macOS defense
Researcher Patrick Wardle surveys OS X ransomware history (KeRanger, FileCoder, Gopher, Mabouia, GinX) and introduces ransomWhere, a heuristic tool detecting rapid file encryption by untrusted processes.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This Objective-See blog post is a research writeup rather than an active-threat advisory. It traces the evolution of macOS ransomware from early browser-locking scareware ('FBI ransomware', 2013) through non-functional PoCs (FileCoder, 2014) to functional proof-of-concept tools (Gopher, Mabouia, 2015) and the first real in-the-wild macOS ransomware, KeRanger, which trojanized the signed Transmission BitTorrent client in March 2016. The author also references GinX, a ransomware-as-a-service offering advertised on an underground marketplace with a Mac variant.
The bulk of the article details the author's methodology for building 'ransomWhere?', a generic ransomware detection tool for macOS. It evaluates several user-mode file I/O monitoring techniques (dtrace, fs_usage/kdebug, OpenBSM, FSEvents API, and direct /dev/fsevents access), settling on direct FSEvents access for efficiency and process attribution. It then describes using statistical tests (entropy, Chi-Square distribution, Monte Carlo pi approximation) to distinguish encrypted files from merely compressed ones, and a trust heuristic (Apple-signed binaries and pre-existing installed apps are trusted) to reduce false positives when flagging processes rapidly creating encrypted files.
No active campaign, vulnerability, or specific victim is reported here; this is defensive tooling research building on prior disclosures (KeRanger by Palo Alto Networks, FileCoder by Kaspersky, Gopher by Pedro Vilaca). Severity is low as the piece is informational/defensive research rather than a report of ongoing exploitation.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x0F.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs