This week security researchers discovered a macOS hack that is encrypting user files and holding them for ransom. This is what it is and how you can avoid it.
macOS Hack
Ransomware attacks on Macs are rare, particularly compared to its PC counterparts. But they can happen. And this week malware researcher Dinesh Devadoss found that one titled OSX. EvilQuest is currently doing the rounds.
This is the third time that macOS ransomware has been discovered over the past four years. According to Apple Insider, EvilQuest can encrypt a user's files and install a keylogger to record keystrokes and a reverse shell to customer commands can be executed on the machine. It can also install a code that targets cryptocurrency wallets.
Devadoss has found that EvilQuest impersonates a Google software update. Director of Mac and Mobile at Malwarebytes, Thomas Reed, told ZDNet that once the malware is executed the encryption begins immediately. After encryption, the ransomware adds a marker BEBABEDD to the EOF.
Pic.Twitter.Com/R610lXkfZ1 — Dinesh_Devadoss (@dineshdina04) June 29, 2020
Once the execution is finished, the user is delivered a pop up that reveals that their files have been encrypted. It also directs the user to a ransom note on their desktop, which takes the form of a plain text file.
Image: Dinesh Devadoss Image: Patrick Wardle The notes demands that $US50 be delivered to the hackers in bitcoin within 72 hours of the encryption taking place. Principal Security Researcher at Jamf, Patrick Wardle, has done a deep dive into the EvilQuest hack here.
READ MORE Aussie Beer and Milk Producer the Target of International 'Ransomware Gang' EvilQuest Files According to ZDNet, EvilQuest will encrypt any files with the following extensions: .Pdf, .Doc, .Jpg, .Txt, .Pages, .Pem, .Cer, .Crt, .Php, .Py, .H, .M, .Hpp, .Cpp, .Cs, .Pl, .P, .P3, .Html, .Webarchive, .Zip, .Xsl, .Xslx, .Docx, .Ppt, .Pptx, .Keynote, .Js, .Sqlite3, .Wallet, .Dat.
In regards to cryptocurrency wallets, it will target file types such as wallet.Pdf, wallet.Png, key.Png and *.P12.
macOS Ransomeware – How To Avoid
According to malware experts, it seems that the EvilQuest MacOS hack is circulating thanks to pirated software. As per Apple Insider, it has been found in pirated versions of Mixed In Key (a DJ app) as well as Little Snitch, a security program. However, this doesn’t mean it hasn’t be hidden in other yet-to-be-found pirated software. So the best course of action is to avoid downloading pirated versions of stuff. Instead, consider going legit and actually paying developers for the products.
In Hindi :-
इस हफ्ते सुरक्षा शोधकर्ताओं ने एक मैकोस हैक की खोज की जो उपयोगकर्ता फ़ाइलों का एन्क्रिप्ट कर रहा है और उन्हें फिरौती के लिए पकड़ रहा है।यह वही है जो है और आप इसे कैसे बचा सकते हैं।
No comments:
Post a Comment
Please do not enter spam link in the comment box.