LockBit tests first macOS ransomware build
Researchers dissected an early, non-functional LockBit ransomware sample compiled for Apple Silicon, confirming it's a test build with no real-world threat to macOS users.
Following a tweet from @MalwareHunterTeam, researcher Patrick Wardle analyzed "locker_Apple_M1_64", an arm64 Mach-O binary appearing to be the first macOS-targeting build from the LockBit ransomware operation. Reverse engineering revealed the sample is largely a recompiled port of LockBit's Windows/Linux/ESXi encryptor, retaining Windows-specific artifacts (autorun.inf, ntuser.dat.log) and no macOS-specific logic beyond a config blob. The binary is only ad-hoc signed, meaning Gatekeeper blocks execution by default, and it lacks any awareness of macOS protections such as SIP or TCC.
Dynamic analysis confirmed the sample does function as ransomware when manually executed and unsigned protections bypassed: it encrypts files, appends a .lockbit extension, and drops a ransom note. However, the binary contains bugs including buffer overflows causing crashes, and Cisco Talos told BleepingComputer the encryptor was a test/beta build never intended for live deployment. LockBit's public representative, LockBitSupp, confirmed the macOS variant is "actively being developed," indicating this is an early step toward future macOS targeting rather than an active campaign.
While the current sample poses no meaningful risk to macOS users due to its lack of code-signing validity and TCC/SIP awareness, its existence signals that a major ransomware gang is investing in macOS capability. The author notes existing generic ransomware detection tools (e.g., RansomWhere?) already catch this sample's file-encryption behavior, underscoring that behavioral detection remains effective even against novel platform ports.
Mentioned in this report
Detection guidance
Suspicious File Encryption with Ransomware Extension Appending
Process encrypting files and appending .lockbit extension - characteristic ransomware behavior detectable via file events showing systematic encryption and extension modification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious File Encryption with Ransomware Extension Appending
description: Detects processes systematically encrypting files and appending .lockbit
extension, characteristic of ransomware encryption activity. Focuses on the file
operation pattern rather than campaign-specific indicators.
tags:
- attack.impact
- attack.t1486
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|endswith:
- .lockbit
filter_installer:
Image|contains:
- /Applications/
- /Library/Application Support/
condition: selection and not filter_installer
falsepositives:
- Backup software performing encryption and renaming operations
- Custom archival tools using .lockbit extension (unlikely but possible)
level: high
id: 50f6e143-0dad-51b7-8c7f-7ed102625bd1
status: experimental
author: Vorant
Debugger Evasion via Gatekeeper Bypass or Ad-Hoc Signing Detection
Execution of ad-hoc or unsigned Mach-O binaries that bypass Gatekeeper validation - typical debugger/protection evasion technique used by macOS malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Debugger Evasion via Gatekeeper Bypass or Ad-Hoc Signing Detection
description: Detects execution of ad-hoc signed or unsigned Mach-O binaries that circumvent
Gatekeeper protection, a common macOS malware evasion technique.
tags:
- attack.defense-evasion
- attack.t1622
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- .o
- .bin
- .app
CommandLine|contains:
- ad-hoc
- unsigned
process_signature_invalid:
SignatureStatus: Invalid
filter_legitimate:
Image|contains:
- /Applications/
- /usr/libexec/
- /System/
condition: (selection or process_signature_invalid) and not filter_legitimate
falsepositives:
- Unsigned third-party or development software
- Legitimate applications with non-standard code-signing status during testing
level: medium
id: d4f02d46-428e-53cf-b720-cab1fab581f8
status: experimental
author: Vorant
Inhibition of System Recovery via Ransom Note Drop
Process dropping ransom note file alongside encrypted files - behavioral indicator of ransomware attempting to inhibit recovery by communicating encryption status to the victim. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inhibition of System Recovery via Ransom Note Drop
description: Detects processes creating ransom note files (e.g., NOTE.txt, RANSOM.txt,
LOCKBIT.txt) in directories containing encrypted files, typical of ransomware inhibiting
system recovery.
tags:
- attack.impact
- attack.t1490
logsource:
category: file_event
product: macos
detection:
selection_ransom:
TargetFilename|contains:
- NOTE.txt
- RANSOM
- LOCKBIT
- HOW_TO_DECRYPT
filter_user_generated:
User|contains: admin
Image|contains:
- /Applications/
- /usr/bin/
condition: selection_ransom and not filter_user_generated
falsepositives:
- Security testing tools dropping sample ransom notes
- Ransomware simulation software
level: high
id: 84f5c9b4-4ab7-5515-92cd-a13051a4b428
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x75.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free