The spyware component also lurks persistently as a backdoor on infected devices, meaning it sticks around even after a computer reboots, and could be used as a launchpad for additional, or 'second stage,' attacks. In addition to ransomware, ThiefQuest has a whole other set of spyware capabilities that allow it to exfiltrate files from an infected computer, search the system for passwords and cryptocurrency wallet data, and run a robust keylogger to grab passwords, credit card numbers, or other financial information as a user types it in. (Researchers originally dubbed it EvilQuest, until they discovered the Steam game series of the same name.)

It turns out, though, that the malware, which researchers are now calling ThiefQuest, gets more interesting from there. So when Dinesh Devadoss, a malware researcher at the firm K7 Lab, published findings on Tuesday about a new example of Mac ransomware, that fact alone was significant. One theory that is becoming more popular as researchers keep analyzing the code was that ThiefQuest started out as a regular infostealer, but was later expanded into ransomware with a low-quality file-encryption module that ended up destroying user files.The threat of ransomware may seem ubiquitous, but there haven't been too many strains tailored specifically to infect Apple's Mac computers since the first full-fledged Mac ransomware surfaced only four years ago. This means that any victims who pay won't likely receive a decryption key to recover their files, as there is no way for the ThiefQuest group to say who paid and who didn't.Īll victims infected by this point should consider their data lost forever, unless researchers find a way to break the encryption and recover their files.Īt the time of writing, security researchers couldn't say for sure if ThiefQuest was created as a ransomware from the get-go, or if the ransomware module was added later, on top of another existing remote access trojan. Furthermore, researchers also noted that the ThiefQuest also doesn't include a method through which victims could contact the ransomware authors, or a method through which the malware authors could track payments.

Ransomware on apple computers