Huntress Makes a macOS Ransomware Script Operational in a Test
Summary
Huntress modified and tested a circulating macOS ransomware script, which creates an encrypted APFS drive, moves files onto it and sends the decryption password to an attacker-controlled machine. The script was last known to work on macOS Monterey.
Key points
- Huntress found a macOS ransomware script that did not work as supplied: its encrypted drive lacked a password, and file exfiltration failed.
- The researchers fixed the script’s file path and disk-targeting assumptions and configured it to use OpenSSL to send the decryption password.
- The demonstrated script creates an encrypted APFS drive, moves selected files onto it, unmounts it and sends the password to the operator.
- Huntress said the tested script was last known to work on macOS Monterey.
- The article presents the exercise as red-team emulation intended to help the company improve its defensive capabilities.
Article Details
- Attack Vectors
- A macOS ransomware Bash script creates an encrypted APFS drive, copies selected files to it, and unmounts the drive.
- The script sends the decryption password to an attacker-controlled machine using OpenSSL.
- The script uses /dev/urandom to generate a random 64-character password and diskutil to identify the APFS container.
- Defensive Notes
- The article describes the script as a red-team emulation for defensive research, not as a reported real-world attack.
- The script was last known to work on macOS Monterey.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe script sends the decryption password to the operator's machine using OpenSSL.T1083 · File and Directory DiscoveryThe script identifies the APFS container with diskutil and selects files and folders to copy.T1486 · Data Encrypted for ImpactThe script creates an encrypted APFS drive on the target Mac and holds the decryption password for ransom.