This macOS malware can wipe your entire device

MacOS users are being warned to monitor their device security following the discovery of a potentially hugely damaging new form of ransomware.

Known as ThiefQuest, the malware targets macOS devices such as MacBooks, encrypting the entire system and stealing valuable data on the device.

If a ransom is not paid to release the files, then ThiefQuest is programmed to completely wipe the victim's device, deleting all items within - however there may be a way to stop it for good.

MacOS malware

ThiefQuest was first detected by researchers at security firm SentinelOne, who were able to carry out a full investigation into the malware.

The company first believed the malware was lacking certain finesse when investigating the ransom message alerting ThiefQuest victims to their fate.

As usual with such alerts, it order victims to pay $50 within 72 hours if they wanted their files returned - however, it neglected to provide any contact email for information about decryption once this was paid, only a link to a ReadMe file containing details on a Bitcoin wallet to send the ransom funds to.

SentinelOne's research found that ThiefQuest (initially known as EvilQuest) used a custom encryption routine, and that its code suggested it was unrelated to the public key encryption methods commonly used for such attacks.

The researchers discovered ThiefQuest was instead looking in the system's /Users folder to try and steal files, with .doc, .pdf and .jpg items all targeted among others. However once found, these files were encrypted by a function that used a simple encoding tool that, when creating an encrypted file, simply added an extra data block containing the encryption/decryption key and the key that encodes it.

The attackers also failed to remove the function responsible for the decryption job, meaning getting the original file back was incredibly straightforward, and allowing SentinelOne to create and release a decryptor, which can be downloaded for free now.

Via BleepingComputer

How It works

Search Crack for

Latest IT News

Aug 5
Microsoft is expanding the calling capabilities in Teams with a new service and dedicated phone systems from its partners.
Aug 5
Microsoft and Samsung have teamed up again to announce a new feature for the excellent Your Phone app in Windows 10.
Aug 5
Messenger ups business offering with new Facebook chat plugin.
Aug 5
Linux Kernel 5.8 is available to download now and includes the highest number of commits.
Aug 4
Microsoft's new Advanced Communications plan allows users to host large-scale meetings and events in Teams.
Aug 4
Windows Credential Manager offers a straightforward way to store your login data in Windows 10.
Aug 4
Partner-only model may signify changes to come for Zoom.

Latest cracks