LockBit tests first macOS ransomware build
Researchers dissected an early, non-functional LockBit ransomware sample compiled for Apple Silicon, confirming it's a test build with no real-world threat to macOS users.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Following a tweet from @MalwareHunterTeam, researcher Patrick Wardle analyzed "locker_Apple_M1_64", an arm64 Mach-O binary appearing to be the first macOS-targeting build from the LockBit ransomware operation. Reverse engineering revealed the sample is largely a recompiled port of LockBit's Windows/Linux/ESXi encryptor, retaining Windows-specific artifacts (autorun.inf, ntuser.dat.log) and no macOS-specific logic beyond a config blob. The binary is only ad-hoc signed, meaning Gatekeeper blocks execution by default, and it lacks any awareness of macOS protections such as SIP or TCC.
Dynamic analysis confirmed the sample does function as ransomware when manually executed and unsigned protections bypassed: it encrypts files, appends a .lockbit extension, and drops a ransom note. However, the binary contains bugs including buffer overflows causing crashes, and Cisco Talos told BleepingComputer the encryptor was a test/beta build never intended for live deployment. LockBit's public representative, LockBitSupp, confirmed the macOS variant is "actively being developed," indicating this is an early step toward future macOS targeting rather than an active campaign.
While the current sample poses no meaningful risk to macOS users due to its lack of code-signing validity and TCC/SIP awareness, its existence signals that a major ransomware gang is investing in macOS capability. The author notes existing generic ransomware detection tools (e.g., RansomWhere?) already catch this sample's file-encryption behavior, underscoring that behavioral detection remains effective even against novel platform ports.
Mentioned in this report
Detection guidance
Suspicious File Encryption with Ransomware Extension Appending
A behavioural hunt for the technique in general.
Process encrypting files and appending .lockbit extension - characteristic ransomware behavior detectable via file events showing systematic encryption and extension modification. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious File Encryption with Ransomware Extension Appending
description: Detects processes systematically encrypting files and appending .lockbit
extension, characteristic of ransomware encryption activity. Focuses on the file
operation pattern rather than campaign-specific indicators.
tags:
- attack.impact
- attack.t1486
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|endswith:
- .lockbit
filter_installer:
Image|contains:
- /Applications/
- /Library/Application Support/
condition: selection and not filter_installer
falsepositives:
- Backup software performing encryption and renaming operations
- Custom archival tools using .lockbit extension (unlikely but possible)
level: high
id: 50f6e143-0dad-51b7-8c7f-7ed102625bd1
status: experimental
author: Vorant
Inhibition of System Recovery via Ransom Note Drop
A behavioural hunt for the technique in general.
Process dropping ransom note file alongside encrypted files - behavioral indicator of ransomware attempting to inhibit recovery by communicating encryption status to the victim. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inhibition of System Recovery via Ransom Note Drop
description: Detects processes creating ransom note files (e.g., NOTE.txt, RANSOM.txt,
LOCKBIT.txt) in directories containing encrypted files, typical of ransomware inhibiting
system recovery.
tags:
- attack.impact
- attack.t1490
logsource:
category: file_event
product: macos
detection:
selection_ransom:
TargetFilename|contains:
- NOTE.txt
- RANSOM
- LOCKBIT
- HOW_TO_DECRYPT
filter_user_generated:
User|contains: admin
Image|contains:
- /Applications/
- /usr/bin/
condition: selection_ransom and not filter_user_generated
falsepositives:
- Security testing tools dropping sample ransom notes
- Ransomware simulation software
level: high
id: 84f5c9b4-4ab7-5515-92cd-a13051a4b428
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x75.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs