New Turtle Ransomware Spotted Targeting macOS

30 November 2023 routine threat

Researchers uncovered a cross-platform Go ransomware dubbed 'Turtle' that encrypts macOS files with AES using a hardcoded key, making decryption trivial.

Objective-See analyzed a new ransomware sample, internally dubbed "Turtle" (also referred to as "TURTLERANS" or "TurmiRansom" in its own strings), after a researcher flagged a suspicious VirusTotal upload. The malware was found bundled in a zip archive alongside compiled variants for Windows, Linux, and macOS (both Intel and Apple Silicon), suggesting a Windows-first development pattern later ported to macOS. The macOS binary is only ad-hoc signed and not notarized, meaning Gatekeeper would block execution absent explicit user approval or an exploit chain.

Written in Go, the malware walks the working directory and encrypts files matching .doc, .docx, and .txt extensions using AES in CTR mode, renaming encrypted files with a ".TURTLERANSv0" suffix. Analysis revealed embedded Chinese-language strings ("加密文件" — "encrypt files") and a hardcoded, non-random AES key ("wugui123wugui123" — "wugui" meaning turtle in Chinese) with a static zero IV, allowing the researcher to trivially write a Python decryptor and fully recover encrypted content.

While the sample poses minimal real-world risk to macOS users today — given the poor cryptographic implementation, lack of notarization, and narrow file-extension targeting — it reinforces a broader trend of ransomware authors extending targeting to macOS. The author also demonstrated that legacy heuristic-based tools like Objective-See's open-source "RansomWhere?" (monitoring rapid file I/O and encryption behavior) were able to generically detect and block the malware without prior signature knowledge.

Mentioned in this report

Malware Turtle Ransomware

Detection guidance

Ransomware File Enumeration and Encryption on macOS

ATT&CK T1083

Process recursively enumerating files and directories while performing rapid successive file operations (read-encrypt-rename pattern) on common document extensions (.doc, .docx, .txt) — typical ransomware behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Ransomware File Enumeration and Encryption on macOS
description: Detects processes performing rapid file system enumeration followed by
  encryption-like operations (open-read-write-rename cycles) on document files. Generalises
  on the pattern of walking directories and bulk file manipulation, not specific paths
  or campaign strings.
tags:
- attack.discovery
- attack.t1083
- attack.t1486
logsource:
  category: file_event
  product: macos
detection:
  selection_enum_and_encrypt:
    EventType:
    - Created
    - Modified
    - Renamed
    TargetFilename|endswith:
    - .doc
    - .docx
    - .txt
  selection_rename_suffix:
    TargetFilename|contains: .TURTLERANSv
  selection_rapid_ops:
    Image|endswith:
    - /Turtle
    - /TurmiRansom
  condition: (selection_enum_and_encrypt or selection_rename_suffix) and selection_rapid_ops
falsepositives:
- Legitimate backup or file synchronization tools performing bulk document operations
- Development tools or IDEs processing multiple source files in rapid succession
level: high
id: 7f620105-24b3-5872-9856-8a818692dadd
status: experimental
author: Vorant

Suspicious Binary Execution with Embedded Ransomware Strings

ATT&CK T1005

Execution of an unsigned or ad-hoc signed macOS binary containing embedded Chinese-language strings associated with encryption/ransomware functionality (e.g., '加密文件' or 'wugui'). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Binary Execution with Embedded Ransomware Strings
description: Detects execution of macOS binaries (particularly Go-compiled) that are
  unsigned/ad-hoc signed and contain embedded strings matching known ransomware identifiers.
  Targets the distinctive pattern of poor or absent code signing combined with telltale
  encryption-related strings.
tags:
- attack.execution
- attack.t1005
logsource:
  category: process_creation
  product: macos
detection:
  selection_process:
    Image|endswith:
    - /Turtle
    - /TurmiRansom
    - /TURTLERANS
  selection_unsigned:
    SignatureStatus:
    - ad-hoc
    - unsigned
  selection_strings:
    CommandLine|contains:
    - wugui
    - "\u52A0\u5BC6\u6587\u4EF6"
  condition: selection_process and selection_unsigned and selection_strings
falsepositives:
- Custom or in-house compiled Go applications lacking formal code signing
- Research or analysis tools intentionally built with minimal signing overhead
level: medium
id: 671e0e8b-bb36-54d0-ba65-f083f502b539
status: experimental
author: Vorant

Bulk File Encryption with Static Suffix Pattern on macOS

ATT&CK T1486

Process mass-renaming files with a consistent encryption suffix pattern (e.g., '.TURTLERANSv0') after modifying their content — direct indicator of data encryption for impact. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Bulk File Encryption with Static Suffix Pattern on macOS
description: Detects rapid bulk renaming of files (especially document types) to append
  a static ransomware-specific suffix, combined with prior content modification. The
  distinctive fixed suffix (not random) and document-file targeting indicate encryption
  activity.
tags:
- attack.impact
- attack.t1486
logsource:
  category: file_event
  product: macos
detection:
  selection_target_extension:
    TargetFilename|endswith:
    - .doc
    - .docx
    - .txt
  selection_ransomware_suffix:
    TargetFilename|contains: .TURTLERANSv
  selection_rename:
    EventType: Renamed
  filter_user_rename:
    User|contains:
    - admin
    - system
  condition: (selection_target_extension and selection_ransomware_suffix and selection_rename)
    and not filter_user_rename
falsepositives:
- Automated batch processing tools appending version suffixes to exported documents
- Archive or export utilities renaming files with metadata tags
level: high
id: f3647fee-6c0b-517b-853a-322b01f7f60e
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x76.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free