Mac OS X – careful not to be taken hostage by KeRanger – ZDNet France

Security researchers have discovered what they believe is the first ransomware attack or rançongiciel targeting Apple Mac users. This threat is currently active on the Internet and spreads via a Torrent file download software.

This attack was detected throughout the weekend by researchers at Palo Alto Networks. They have therefore identified a ransomware, “KeRanger”, hidden in a popular BitTorrent client for OS X, Transmission.

$ 400 to retrieve his files

however, this is not really the first time that malware family of ransomware is detected in OS X. Kaspersky Labs had indeed identified in 2014. But according to Palo Alto Networks, ” KeRanger “is the” first fully functional ransomware seen on the OS X platform. “

” This is the first in nature that is certainly functional, encrypts your files and seeking ransom “told Reuters the director of the Palo Alto threat Intelligence, Ryan Olson.

KeRanger is bad news for Mac users, globally so far spared this type of computer threat. A ransomware is designed to infect a computer and restrict access to the hard drive files by encrypting them.

Apple has already responded to the attack

If it wishes to regain access to their data, the infected user has to adjust with KeRanger prior to the cybercriminal quite substantial ransom: $ 400. The infection is thus effected via a compromised version of Transmission client.

Initially, the target of this attack is not alerted. But three days after installation, the ransomware connects with servers in the Tor network and begins to encrypt some files from one OS X.

“After completing the process encryption, KeRanger asks victims to pay a bitcoin (about $ 400) to a specific address to retrieve their files, “security researchers explain.

“In addition, KeRanger seems to be still in active development and it appears that the malware also attempts to encrypt backup files Time Machine to prevent the victims to recover their backup data” add -they.

Palo Alto Networks alerted Apple to the attack on 4 March. Since the firm revoked the security certificate used by KeRanger and updated its antivirus software XProtect. Apple declined to comment on this ransomware.