LockBit Ransomware Expands Attack Spectrum to Mac Devices

****Analysis by Apple’s Patrick Wardle confirms that Lockbit ransomware “poses no threat to macOS users.”****

LockBit ransomware gang is reportedly developing a new version of malware that can encrypt files on Apple macOS, as revealed by MalwareHunterTeam. This would be the first instance of malware targeting Mac devices, as LockBit has previously focused on Linux and Windows devices.

The ransomware group is known for its RaaS (ransomware-as-a-service) operation, lending ransomware to cybercriminals for a fee. The new malware is named locker_Apple_M1_64, and there are separate versions for PowerPC Macs as well.

****Malware Details:****

The new malware, locker_Apple_M1_64, was first detected targeting Mac devices in November 2022, according to Vx-Underground, a platform that examines malware samples. It has not been detected by any anti-malware engines on VirusTotal, but information about this malware has been limited since last fall.

Researchers have noted that the LockBit ransomware gang is expanding its attack spectrum by targeting Macs, which marks a significant development in their tactics.

Not a single person I can find tweeted LockBit has a Mac targeting version before I did above yesterday, nor can find any blog posts mentioning it, etc. So even if the gang had the first build in 2022 November, for public, this is not late at all, but even yet, seems the first… pic.twitter.com/4iR71cuLpo

— MalwareHunterTeam (@malwrhunterteam) April 16, 2023

****Expert Analysis:****

According to Patrick Wardle, a security researcher and founder of Objective-See, while the malware is capable of running on Macs, it does not pose a serious risk due to several factors. The malware sample analyzed by Wardle was not signed by a trusted certificate, which means macOS won’t run it.

Additionally, Apple’s file system protection solutions such as Transparency, Consent, and Control/TCC would limit the impact of the malware even if it manages to infiltrate a macOS device. Moreover, the malware had bugs, and Wardle concluded that it was not ready for prime time.

In a blog post, Wardle stated that the ransomware is buggy and contains flaws, including buffer overflows that cause it to prematurely exit.

While this may be the first time a large ransomware group created ransomware capable of running on macOS, it is worth noting that this sample is far from ready for prime time […] From its lack of a valid code-signing signature to its ignorance of TCC and other macOS file-system protections as it stands it poses no threat to macOS users.

Patrick Wardle

****Conclusion:****

In conclusion, the LockBit ransomware gang’s development of a macOS version of malware targeting Mac devices is a significant development in their attack tactics. However, based on Apple’s analysis, the current version of the malware does not pose a serious risk to macOS devices due to security measures in place.

Nevertheless, it underscores the need for continued vigilance against evolving malware threats and the importance of robust cybersecurity measures to protect against ransomware attacks on all platforms.

1. BitTorrent sites drop crypto-ransomware on macOS
2. EvilQuest ransomware hits macOS via pirated software
3. macOS malware XcodeSpy sneaking into spy on victims