Security researchers have discovered this week a new ransomware strain targeting macOS users.
Named OSX.EvilQuest, this ransomware is different from previous macOS ransomware threats because besides encrypting the victim's files, EvilQuest also installs a keylogger, a reverse shell, and steals cryptocurrency wallet-related files from infected hosts.
"Armed with these capabilities, the attacker can main full control over an infected host," said Patrick Wardle, Principal Security Researcher at Jamf. This means that even if victims paid, the attacker would still have access to their computer and continue to steal files and keyboard strokes.
Wardle is currently one of the many macOS security researchers who are analyzing this new threat.
Others who are also investigating EvilQuest includeThomas Reed, Director of Mac & Mobile at Malwarebytes, andPhil Stokes, macOS security researcher at SentinelOne.
Reed and Stokes are currently looking for a weakness or bug in the ransomware's encryption scheme that could be exploited to create a decryptor and help infected victims recover their files without paying the ransom.
But the researcher who first spotted the new EvilQuest ransomware is K7 Lab security researcher Dinesh Devadoss.
Devadosstweetedabout his finding yesterday, June 29. However, new evidence surfaced in the meantime has revealed that EvilQuest has been, in reality, distributed in the wild since the start of June 2020.
Reed toldZDNetin a phone call today that Malwarebytes has found EvilQuest hidden inside pirated macOS software uploaded on torrent portals and online forums.
Devadoos has spotted EvilQuest hidden in a software package called Google Software Update, Wardle has found samples of EvilQuest inside a pirated version of popular DJ software Mixed In Key, and Reed has spotted it hidden inside the macOS security tool called Little Snitch.
However, Reed told us he believes the ransomware is most likely more broadly distributed, leveraging many more other apps, and not just these three.
Wardle, who published anin-depth technical analysis of EvilQuestearlier today, said the malware is pretty straightforward, as it moves to encrypt the user's files as soon as it's executed.
Once the file encryption scheme ends, a popup is shown to the user, letting the victim know they've been infected and their files encrypted.
The victim is directed to open a ransom note in the form of a text file that has been placed on their desktop, which looks like the one below:
Stokes toldZDNetthe ransomware will encrypt any files with the following file extensions:
.pdf, .doc, .jpg, .txt, .pages, .pem, .cer, .crt, .php, .py, .h, .m, .hpp, .cpp, .cs, .pl, .p, .p3, .html, .webarchive, .zip, .xsl, .xslx, .docx, .ppt, .pptx, .keynote, .js, .sqlite3, .wallet, .dat
After the encryption process ends, the ransomware installs a keylogger to record all the user's keystrokes, a reverse shell so the attacker can connect to the infected host and run custom commands, and will also look to steal the following types of files, usually employed by cryptocurrency wallet applications.
Wardle, who has created several open-source macOS security tools, said that a tool he released in 2016, namedRansomWhere, can detect and stop EvilQuest from running.
EvilQuest is the third ransomware strain that has exclusively targeted macOS users afterKeRangerandPatcher. Another macOS ransomware strain calledMabouiaonly existed at a theoretical level and was never released in the real world.
Comments
Post a Comment