VORANT. Threat Intelligence Sign in Get the full feed

2016's Mac Malware: KeRanger to Komplex Reviewed

routine threat

Objective-See recaps six new macOS malware families from 2016, including the first Mac ransomware KeRanger and a Fancy Bear implant, Komplex.

This retrospective from Objective-See catalogs the notable new macOS malware strains observed in 2016, walking through infection vectors, persistence mechanisms, features, and disinfection steps for each. Highlights include OSX/KeRanger, the first fully-functional in-the-wild ransomware for OS X, distributed via a compromised build of the Transmission BitTorrent client; OSX/Keydnap, a Tor-based credential-stealing backdoor later distributed through the same compromised Transmission website; OSX/Eleanor, a PHP-based backdoor that turns infected Macs into hidden Tor services distributed via a fake 'EasyDoc Convertor' app; OSX/FakeFileOpener, an adware family notable for a novel persistence trick abusing document-handler registration; OSX/Mokes, a full-featured backdoor capable of keylogging, screen/audio/video capture and document theft; and OSX/Komplex, attributed with low-to-medium confidence to Russia's APT28/Fancy Bear, delivered via email attachments disguised as PDFs about the Russian aerospace program.

Several of these campaigns show a recurring pattern of supply-chain compromise (the Transmission website was hacked twice to distribute both KeRanger and Keydnap) and abuse of legitimate developer certificates to bypass Gatekeeper. Persistence overwhelmingly relies on user LaunchAgents, and several families (Keydnap, Eleanor) leverage Tor or Tor2Web proxies for C2 and exfiltration. The report is a historical/informational compilation rather than a live threat notification — all samples were previously reported by AV vendors and most have been mitigated via Apple certificate revocations and XProtect signature updates.

Mentioned in this report

Threat actors APT28
Malware EleanorFakeFileOpenerKeRangerKeydnapKomplexMokes

Related reporting

Detection guidance

Suspicious Launch Agent Creation for Persistence

ATT&CK T1543.001

Process or script creating a plist file in ~/Library/LaunchAgents/ with executable payload — typical macOS malware persistence, rare in legitimate user workflows. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Launch Agent Creation for Persistence
description: Detects creation of plist files in ~/Library/LaunchAgents/ containing
  references to executable payloads or scripts. Malware commonly abuses LaunchAgents
  for persistence; legitimate software rarely writes directly to this user directory
  during normal operation.
tags:
- attack.persistence
- attack.t1543.001
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains: /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  filter_package_managers:
    Image|contains:
    - /usr/local/bin/brew
    - /opt/homebrew/bin/brew
  filter_legitimate_apps:
    Image|contains:
    - /Applications/
    - /System/Library/
  condition: selection and not filter_package_managers and not filter_legitimate_apps
falsepositives:
- User-installed legitimate applications using LaunchAgents for background updates
- Custom deployment scripts in corporate environments
level: medium
id: a966079d-ccf0-5d55-bf9f-ce7c6d7999c7
status: experimental
author: Vorant

Suspicious Keychain Access for Credential Theft

ATT&CK T1555.001

Process accessing or querying the macOS Keychain database (via security command or direct keychain library calls) without user authorization popup — credential-theft behaviour. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Keychain Access for Credential Theft
description: Detects processes invoking keychain access tools or APIs to query stored
  credentials without legitimate user interaction. Malware families like OSX/Keydnap
  and OSX/Mokes leverage keychain dumping for credential exfiltration.
tags:
- attack.credential-access
- attack.t1555.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_security:
    Image|endswith: /security
    CommandLine|contains:
    - dump-keychain
    - find-generic-password
    - find-internet-password
  selection_process_load:
    Image: /usr/bin/python
    CommandLine|contains: keychain
  filter_legitimate:
    ParentImage|contains:
    - /Applications/1Password
    - /Applications/Keychain
    - /System/Library/
  condition: (selection_security or selection_process_load) and not filter_legitimate
falsepositives:
- Password manager applications querying keychain during normal operation
- System utilities or IT tools accessing keychain for legitimate credential sync
level: high
id: 0ea077bf-2778-51cb-b706-f31c1a6f3b47
status: experimental
author: Vorant

Suspicious Tor or Proxy Process Spawned by User Application

ATT&CK T1090.003

Non-system application spawning Tor daemon or proxy tools (tor, torsocks, privoxy) for C2 communication — typical backdoor anonymization pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Tor or Proxy Process Spawned by User Application
description: Detects user-space applications launching Tor, Tor2Web proxies, or similar
  anonymization tools for command & control. Malware families like OSX/Keydnap and
  OSX/Eleanor rely on Tor for encrypted C2 and data exfiltration.
tags:
- attack.command-and-control
- attack.t1090.003
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|contains:
    - /tor
    - /torsocks
    - /privoxy
    ParentImage|contains: /Applications/
  filter_tor_browser:
    ParentImage|contains: Tor Browser
  filter_legitimate_vpn:
    ParentImage|contains:
    - ExpressVPN
    - NordVPN
    - ProtonVPN
  condition: selection and not filter_tor_browser and not filter_legitimate_vpn
falsepositives:
- Legitimate Tor Browser or privacy-focused applications spawning Tor daemon
- Corporate VPN clients that bundle proxy tools
level: medium
id: 84e4b2b7-beef-5100-a996-332085fca01d
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x16.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free