Microsoft warns of different ransomware families targeting Apple macOS systems

guest · Jan 6, 2023

By Pierluigi Paganini - January 6, 2023

Microsoft Security Threat Intelligence team warns of four different ransomware families (KeRanger, FileCoder, MacRansom, and EvilQuest) that impact Apple macOS systems.
Click to expand...

The initial vector in attacks involving Mac ransomware typically relies on user-assisted methods, such as downloading and running fake or weaponized applications. The ransomware can also be delivered as a second-stage payload dropper or part of a supply chain attack.

The experts state that malware creators abuse legitimate functionalities and implement various techniques to exploit vulnerabilities, evade defenses, or trick users into infecting their devices.
Click to expand...

Persistence is maintained by creating launch agents or launch daemons or using kernel queues.

“The ransomware families we analyzed often share similar anti-analysis and persistence techniques. However, these same ransomware families differ in encryption logic. Some use AES-RSA encryptions, while others use system utilities, XOR routine, or custom encryption logic to encrypt files. These encryption methods range from in-place modification to creating a new file while deleting the original one.” reads the analysis published by Microsoft. “Common among the ransomware observed is adding a new extension or simply encrypting the file without adding any new one.”
Click to expand...

Microsoft: Unraveling the techniques of Mac ransomware

January 5, 2023
This blog provides details from our analysis of known ransomware families affecting macOS devices. As in other platforms, the initial vector of Mac ransomware typically relies on user-assisted methods like downloading and running fake or trojanized applications. It can, however, also arrive as a second-stage payload dropped or downloaded by other malware or part of a supply chain attack. Once running on a device, ransomware attacks usually comprise gaining access, execution, encrypting target users’ files, and notifying the target with a ransom message.
Click to expand...

To perform these actions, malware creators abuse legitimate functionalities and devise various techniques to exploit vulnerabilities, evade defenses, or coerce users to infect their devices. We describe these techniques in detail below, based on our analysis of four Mac ransomware families: KeRanger, FileCoder, MacRansom, and EvilQuest. In particular, we take a deeper look at EvilQuest and one of its variants that had its ransomware component removed but was further improved with additional techniques and anti-analysis logic.
Click to expand...

Rasheed187 · Jan 7, 2023

The question is once again, could these ransomware samples be stopped by macOS built-in protection like Gatekeeper and XProtect? That would be interesting to know. I did read that EvilQuest tries to disable security products, but it's not clear which ones. Of course it's no surprise that Microsoft Defender for macOS (enterprise product) stops these samples, since this article is supposed to be a showcase.

EASTER · Jan 7, 2023

Microsoft warns Mac? And why doesn't Apple Mac warn it's users?

Rasheed187 · Jan 8, 2023

EASTER said: ↑

Microsoft warns Mac? And why doesn't Apple Mac warn it's users?
Click to expand...

Like I said, it's a showcase for M$ products. I guess this stuff is only a problem when these malware samples are still in the zero day stage, which might allow them to bypass stuff like Gatekeeper and XProtect, which aren't exactly super advanced. But they will still of course block most of the ''in the wild'' malware.

EASTER · Jan 8, 2023

Rasheed187 said: ↑

Like I said, it's a showcase for M$ products. I guess this stuff is only a problem when these malware samples are still in the zero day stage, which might allow them to bypass stuff like Gatekeeper and XProtect, which aren't exactly super advanced. But they will still of course block most of the ''in the wild'' malware.
Click to expand...

Thanks for your input on it @Rasheed187 - I may be at the bottom of the list where concerns anything Apple/Mac yet it would seem rises to some concern when Microsoft doesn't take it likely, even in the interest of it's competitors when it's got to be a good one (potential bypass attack vector)

Rasheed187 · Jan 11, 2023

EASTER said: ↑

Thanks for your input on it @Rasheed187 - I may be at the bottom of the list where concerns anything Apple/Mac yet it would seem rises to some concern when Microsoft doesn't take it likely, even in the interest of it's competitors when it's got to be a good one (potential bypass attack vector)
Click to expand...

It isn't the first time that MS warned about serious security bugs in macOS though, see links. Of course they also do this to showcase their knowledge of the macOS and their ability to possibly protect against malware abusing these bugs with Microsoft Defender. I just wish they were a bit better in spotting the security bugs found in Windows LOL.

Microsoft has published the exploit code for a vulnerability in macOS that could help an attacker bypass sandbox restrictions and run code on the system.
Click to expand...

https://www.bleepingcomputer.com/ne...ploit-for-macos-sandbox-escape-vulnerability/

While Apple has restricted TCC access only to apps with full disk access and set up features to automatically block unauthorized code execution, Microsoft security researchers found that attackers could plant a second, specially crafted TCC database that would allow them to access protected user info.
Click to expand...

https://www.bleepingcomputer.com/ne...ug-gives-access-to-protected-macos-user-data/

Attackers could use a new macOS vulnerability discovered by Microsoft to bypass System Integrity Protection (SIP) and perform arbitrary operations, elevate privileges to root, and install rootkits on vulnerable devices.
Click to expand...

https://www.bleepingcomputer.com/ne...less-bug-lets-hackers-install-macos-rootkits/

Log in or Sign up

Microsoft warns of different ransomware families targeting Apple macOS systems

guest Guest

Rasheed187 Registered Member

EASTER Registered Member

Rasheed187 Registered Member

EASTER Registered Member

Rasheed187 Registered Member

Log in or Sign up

Microsoft warns of different ransomware families targeting Apple macOS systems

guest Guest

Rasheed187 Registered Member

EASTER Registered Member

Rasheed187 Registered Member

EASTER Registered Member

Rasheed187 Registered Member

Useful Searches