Full Report
With the beta release of the Huntress macOS agent, we wanted to share some of the Apple-y stuff we’ve been up to behind the scenes.
Analysis Summary
# Tool/Technique: macOS Ransomware Bash Script (Huntress Enhanced)
## Overview
This is a proof-of-concept (PoC) macOS ransomware script discovered in the wild as a template and subsequently refined by Huntress researchers. Its purpose is to automate the encryption of sensitive user data on macOS systems by leveraging native Apple utilities, specifically for the purpose of extortion.
## Technical Details
- **Type:** Malware (Ransomware / Bash Script)
- **Platform:** macOS
- **Capabilities:** Automated discovery of APFS containers, volume encryption, file exfiltration, and secure credential delivery.
- **First Seen:** November 8, 2022 (Huntress Publication Date)
## MITRE ATT&CK Mapping
- **TA0010 - Exfiltration**
- T1048.003 - Exfiltration Over Unsymmetric Encrypted Non-C2 Protocol
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- **TA0007 - Discovery**
- T1082 - System Information Discovery (Disk/Container identification)
- **TA0009 - Collection**
- T1560 - Archive Collected Data
## Functionality
### Core Capabilities
- **Target Identification:** Uses `diskutil` combined with `grep` and `awk` to dynamically identify the Apple File System (APFS) container number.
- **Data Encryption:** Creates a new encrypted disk volume using native macOS tools, moves targeted files into this volume, and then unmounts it to deny user access.
- **Credential Generation:** Generates a random 64-character password via `/dev/urandom` for the encrypted volume.
- **Data Exfiltration:** Uses `curl` to send stolen files to an attacker-controlled endpoint.
### Advanced Features
- **Secure C2 Alternative:** Employs `OpenSSL` to send the decryption password to the attacker. This ensures the connection is encrypted and avoids the need for a complex Command and Control (C2) framework.
- **Anti-Forensics:** The script utilizes `p=""` to clear the password variable from memory immediately after use, frustrating memory dump analysis and Digital Forensics and Incident Response (DFIR) efforts.
## Indicators of Compromise
- **File Names:** Common scripts found in `/tmp/` or hidden directories; references to `exfil` directories.
- **Network Indicators:** Outbound `OpenSSL` connections to unfamiliar IP addresses; `curl` requests to unknown domains or IP addresses (e.g., `127.0.0.1` in testing, but external in real attacks).
- **Behavioral Indicators:**
- Execution of `diskutil` to query APFS container information.
- Unexpected unmounting of disk volumes.
- High disk I/O related to moving files to a newly created volume.
- Use of `openssl s_client` for outbound data transfer.
## Associated Threat Actors
- This specific script was identified as a template circulating in underground forums (Telegram, Discord, and Russian-language forums), available for use by various low-to-mid-tier cybercriminals targeting macOS.
## Detection Methods
- **Signature-based detection:** Monitoring for the specific Bash one-liner syntax and the use of `/dev/urandom` for 64-character variable generation.
- **Behavioral detection:**
- Alerting on `diskutil info / | grep 'APFS Container:'`.
- Monitoring for the creation of new encrypted volumes by non-admin users or automated scripts.
- Detecting unusual usage of `openssl s_client` in the command line.
## Mitigation Strategies
- **Prevention measures:** Implementation of "Full Disk Access" (FDA) restrictions to prevent scripts from accessing sensitive user directories (e.g., Documents, Desktop, Photos).
- **Hardening recommendations:** Use an Endpoint Detection and Response (EDR) solution (like the Huntress macOS agent) that monitors for malicious process behaviors and persistence mechanisms.
- **User Education:** Dispelling the myth that macOS is immune to ransomware to ensure users maintain offline backups.
## Related Tools/Techniques
- **Native Binaries (Living off the Land):** `diskutil`, `openssl`, `curl`, `awk`.
- **LockBit:** Known to have developed macOS-specific ransomware variants.
- **Mac Ransom:** A previous example of macOS-targeted ransomware.