VORANT. Threat Intelligence Sign in Get the full feed

Objective-See unveils ransomWhere macOS defense

routine threat

Researcher Patrick Wardle surveys OS X ransomware history (KeRanger, FileCoder, Gopher, Mabouia, GinX) and introduces ransomWhere, a heuristic tool detecting rapid file encryption by untrusted processes.

This Objective-See blog post is a research writeup rather than an active-threat advisory. It traces the evolution of macOS ransomware from early browser-locking scareware ('FBI ransomware', 2013) through non-functional PoCs (FileCoder, 2014) to functional proof-of-concept tools (Gopher, Mabouia, 2015) and the first real in-the-wild macOS ransomware, KeRanger, which trojanized the signed Transmission BitTorrent client in March 2016. The author also references GinX, a ransomware-as-a-service offering advertised on an underground marketplace with a Mac variant.

The bulk of the article details the author's methodology for building 'ransomWhere?', a generic ransomware detection tool for macOS. It evaluates several user-mode file I/O monitoring techniques (dtrace, fs_usage/kdebug, OpenBSM, FSEvents API, and direct /dev/fsevents access), settling on direct FSEvents access for efficiency and process attribution. It then describes using statistical tests (entropy, Chi-Square distribution, Monte Carlo pi approximation) to distinguish encrypted files from merely compressed ones, and a trust heuristic (Apple-signed binaries and pre-existing installed apps are trusted) to reduce false positives when flagging processes rapidly creating encrypted files.

No active campaign, vulnerability, or specific victim is reported here; this is defensive tooling research building on prior disclosures (KeRanger by Palo Alto Networks, FileCoder by Kaspersky, Gopher by Pedro Vilaca). Severity is low as the piece is informational/defensive research rather than a report of ongoing exploitation.

Mentioned in this report

Malware GinXGopherKeRangerMabouiaOSX/FileCoder

Related reporting

Detection guidance

Rapid File Encryption Activity by Unsigned Process

ATT&CK T1486

Detects a process rapidly creating encrypted files (high entropy) across multiple directories — typical ransomware behaviour, distinguished from legitimate compression by statistical entropy analysis. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Rapid File Encryption Activity by Unsigned Process
description: Detects processes creating files with high entropy (encrypted) at an
  abnormal rate across multiple directories. Excludes Apple-signed binaries and pre-installed
  system utilities. Ransomware typically encrypts files in bursts; legitimate tools
  like backup/compression are signed or whitelisted.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: macos
detection:
  selection:
    Image|contains:
    - /tmp/
    - /var/tmp/
    - /Users/
    EventType: CreatedFile
    Entropy|gte: 7.5
  filter_signed:
    SignatureStatus: Valid
  filter_system:
    Image|startswith:
    - /Applications/
    - /System/
    - /usr/bin/
    - /usr/local/bin/
  condition: selection and not filter_signed and not filter_system
falsepositives:
- Third-party archivers (7-Zip, WinRAR equivalents) if running unsigned
- Database tools creating encrypted backups
level: high
id: e880ae30-9d0c-5af0-ab00-37f8916ad6a7
status: experimental
author: Vorant

Suspicious Process Spawning from Trojanized Application Bundle

ATT&CK T1195.002

Detects child processes spawned from legitimate application bundles (e.g. BitTorrent clients, browsers) where the parent executable does not match the bundle's expected code-signing identity or was recently modified. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Process Spawning from Trojanized Application Bundle
description: Detects when a legitimate signed application (e.g. Transmission, browser)
  spawns a child process that is unsigned or has a mismatched code signature, or the
  parent binary was recently modified. Indicates potential trojanization or post-compromise
  code injection.
tags:
- attack.persistence
- attack.t1195.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains:
    - /Applications/Transmission.app/
    - /Applications/Google Chrome.app/
    - /Applications/Firefox.app/
    - /Applications/Safari.app/
    Image|endswith:
    - /bash
    - /sh
    - /zsh
    - /curl
    - /wget
  filter_legitimate_child:
    ParentSignatureStatus: Valid
    CommandLine|contains:
    - --version
    - --help
  condition: selection and not filter_legitimate_child
falsepositives:
- Browser extensions legitimately spawning curl/wget for updates
- Transmission spawning shell for legitimate plugin use
level: medium
id: 180d3285-0fa5-5bce-a057-f6b93519516d
status: experimental
author: Vorant

Process Creating Encrypted Files in Bulk Across User Directories

ATT&CK T1486

Detects a non-system process creating multiple files with encrypted (high-entropy) content within a short timeframe across user home and document directories, excluding legitimate backup/archival tools. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Creating Encrypted Files in Bulk Across User Directories
description: Monitors for rapid file creation with encrypted content (entropy > 7.5)
  across multiple user directories. Filters out Apple-signed processes and known benign
  tools. Ransomware exhibits a characteristic burst of encryption across /Users, Desktop,
  Documents.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: macos
detection:
  selection:
    EventType: CreatedFile
    TargetPath|contains:
    - /Users/*/Desktop/
    - /Users/*/Documents/
    - /Users/*/Downloads/
    Entropy|gte: 7.8
  filter_system_process:
    Image|startswith:
    - /System/
    - /usr/bin/
    - /bin/
  filter_signed:
    SignatureStatus: Valid
  filter_known_benign:
    Image|endswith:
    - /rsync
    - /tar
  condition: selection and not filter_system_process and not filter_signed and not
    filter_known_benign
falsepositives:
- Legitimate encryption tools (Veracrypt, encrypted backup utilities) if unsigned
- Network sync tools (Dropbox, OneDrive) during first-time backup
level: high
id: 1bd645f7-7b72-565e-8b95-a171ecb490f9
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x0F.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free