New OS X Ransomware KeRanger Infected Transmission Bit Torrent Client Installer
Summary: On March 4, Palo Alto Networks detected that two installers of Transmission version 2.90 for OS X were infected with ransomware it named KeRanger, which it describes as the first fully functional ransomware seen on the OS X platform. The KeRanger app was signed with a valid Mac development certificate (developer ID Z7276PX673, a Turkish company) so it bypassed Gatekeeper, waited three days before contacting C2 servers over Tor, then encrypted files under /Users and certain extensions under /Volumes and demanded one bitcoin (about $400).
Key Takeaway: A valid Apple developer certificate and a three-day sleep timer defeated both Gatekeeper and the usual urgency of a fast-moving attack, and the malware already contained an unused _encrypt_timemachine function aimed at destroying the backups victims would rely on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026