Apple pulls the plug on KeRanger ransomware for Mac

For those who have yet to learn about the threat of ransomware, this type of malware has been in existence for a few years and it’s designed to hold files at ransom, by encrypting the content of the victim’s hard drive, and displaying a request to pay large amounts of money in exchange for the encryption key.

The ransom is usually pays through a nearly untraceable currency, such as BitCoin. Due to the fact that ransomware encrypts the content of a hard drive, there is no way to recover anything without the encryption key, which means that paying the ransom is the only way to recover the data.

While the majority of ransomware attacks are typically performed on Windows PCs, Mac users and Linux users need to be just as aware of this threat, as no system is immune to ransomware. As of late, KeRanger, the first functional ransomware created to target computers running Mac OS X, has been identified by Apple, which was able to block KeRanger’s access to Mac users, by revoking a rogue app development certificate used to spread the host application harboring KeRanger. The app in question was called FileCoder, and reports say it was still incomplete at the time of discovery. This has lead Apple to believe that KeRanger may be the first functional ransomware capable of targeting Mac OS X.

Palo Alto Networks’s director of Threat Intelligence, Ryan Olson, said that hackers were successful in infecting two installation files for the open source BitTorrent client “Transmission”, with a set ransom of $400.

Apple has revoked the certificate ever since, and protections for “KeRanger.A malware” has been added to XProtect. With that said, KeRanger isn’t likely to remain the last attempt to target Mac users with ransomware.

The relatively conservative amount set for Transmission’s users could be further confirmation that hackers are definitely intent on targeting greater numbers of Mac users on the future, which is why it’s very important to keep Mac OS X up to date.