New ‘Turtle’ macOS Ransomware Analyzed

[CyberTech]

Content source

https://www.securityweek.com/new-turtle-macos-ransomware-analyzed/

Patrick Wardle, the famed cybersecurity researcher specializing in Apple products, has conducted an analysis of a new macOS ransomware named Turtle.

Wardle’s analysis suggests that the Turtle ransomware is currently not sophisticated, but the malware’s existence indicates that cybercriminals continue to show an interest in targeting macOS users.

Versions of the Turtle ransomware appear to have been created for Windows and Linux systems as well.

Several of the vendors on VirusTotal already detect Turtle as a potential threat, which is unusual for a new piece of malware targeting macOS, but may be explained by similarities to the Windows version, for which crowdsourced YARA rules exist.

The malware was developed in Go and, based on strings found in the binary, ‘Turtle’ appears to be the name given by its author.

The rest

New 'Turtle’ macOS Ransomware Analyzed

New Turtle macOS ransomware is not sophisticated but shows that cybercriminals continue to target Apple devices.

www.securityweek.com

 

[ShenguiTurmi]

I would like to make it clear that I wrote this set of tools, but they have not been used in any illegal situation, as my purpose was a research. I wonder how quickly security software vendors will notice a "new" ransomware on a non-mainstream platform.
The best evidence of not being used in illegal scenarios is that I didn't even generate a ransom note.
I uploaded the samples to VirusTotal/MetaDefender/Triage as soon as I finished writing them and reported them to all the security vendors I could contact.
I even prepared a post documenting the process by which they detected it, if you can use web translation.
https://bbs.kafan.cn/thread-2263204-1-1.html
Time to put an end to this farce...

 

[Trident]

@ShenguiTurmi you are a treasure here at MalwareTips!

 

[Origami_Alpha]

that’s my boss’s testing ransomware…