2016's Mac Malware: KeRanger to Komplex Reviewed

Objective-See recaps six new macOS malware families from 2016, including the first Mac ransomware KeRanger and a Fancy Bear implant, Komplex.

This retrospective from Objective-See catalogs the notable new macOS malware strains observed in 2016, walking through infection vectors, persistence mechanisms, features, and disinfection steps for each. Highlights include OSX/KeRanger, the first fully-functional in-the-wild ransomware for OS X, distributed via a compromised build of the Transmission BitTorrent client; OSX/Keydnap, a Tor-based credential-stealing backdoor later distributed through the same compromised Transmission website; OSX/Eleanor, a PHP-based backdoor that turns infected Macs into hidden Tor services distributed via a fake 'EasyDoc Convertor' app; OSX/FakeFileOpener, an adware family notable for a novel persistence trick abusing document-handler registration; OSX/Mokes, a full-featured backdoor capable of keylogging, screen/audio/video capture and document theft; and OSX/Komplex, attributed with low-to-medium confidence to Russia's APT28/Fancy Bear, delivered via email attachments disguised as PDFs about the Russian aerospace program.

Several of these campaigns show a recurring pattern of supply-chain compromise (the Transmission website was hacked twice to distribute both KeRanger and Keydnap) and abuse of legitimate developer certificates to bypass Gatekeeper. Persistence overwhelmingly relies on user LaunchAgents, and several families (Keydnap, Eleanor) leverage Tor or Tor2Web proxies for C2 and exfiltration. The report is a historical/informational compilation rather than a live threat notification — all samples were previously reported by AV vendors and most have been mitigated via Apple certificate revocations and XProtect signature updates.

Source reporting: https://objective-see.org/blog/blog_0x16.html