# Objective-See unveils ransomWhere macOS defense

Published: 2026-08-02 · Severity: low
Canonical: https://vorant.io/reports/3daf5564-b984-5607-8d21-08b57cb2f441/objective-see-unveils-ransomwhere-macos-defense

> Researcher Patrick Wardle surveys OS X ransomware history (KeRanger, FileCoder, Gopher, Mabouia, GinX) and introduces ransomWhere, a heuristic tool detecting rapid file encryption by untrusted processes.

This Objective-See blog post is a research writeup rather than an active-threat advisory. It traces the evolution of macOS ransomware from early browser-locking scareware ('FBI ransomware', 2013) through non-functional PoCs (FileCoder, 2014) to functional proof-of-concept tools (Gopher, Mabouia, 2015) and the first real in-the-wild macOS ransomware, KeRanger, which trojanized the signed Transmission BitTorrent client in March 2016. The author also references GinX, a ransomware-as-a-service offering advertised on an underground marketplace with a Mac variant.

The bulk of the article details the author's methodology for building 'ransomWhere?', a generic ransomware detection tool for macOS. It evaluates several user-mode file I/O monitoring techniques (dtrace, fs_usage/kdebug, OpenBSM, FSEvents API, and direct /dev/fsevents access), settling on direct FSEvents access for efficiency and process attribution. It then describes using statistical tests (entropy, Chi-Square distribution, Monte Carlo pi approximation) to distinguish encrypted files from merely compressed ones, and a trust heuristic (Apple-signed binaries and pre-existing installed apps are trusted) to reduce false positives when flagging processes rapidly creating encrypted files.

No active campaign, vulnerability, or specific victim is reported here; this is defensive tooling research building on prior disclosures (KeRanger by Palo Alto Networks, FileCoder by Kaspersky, Gopher by Pedro Vilaca). Severity is low as the piece is informational/defensive research rather than a report of ongoing exploitation.

## Mentioned in this report

- Malware: GinX, Gopher, KeRanger, Mabouia, OSX/FileCoder

Source reporting: https://objective-see.org/blog/blog_0x0F.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3daf5564-b984-5607-8d21-08b57cb2f441/objective-see-unveils-ransomwhere-macos-defense.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup