KeRanger

KeRanger is a macOS ransomware family widely regarded as the first fully functional ransomware observed in the wild targeting OS X/macOS. It emerged in March 2016 and was distributed through a supply-chain compromise of the legitimate Transmission BitTorrent client, whose installer was trojanized and signed with a valid Apple-issued developer certificate, allowing the malware to bypass Gatekeeper protections under default settings. The campaign reportedly infected thousands of Mac users.

After execution via the compromised Transmission application, KeRanger installs and launches a hidden payload, delays activity for several days, then profiles the host and contacts attacker-controlled infrastructure reachable through Tor-related services. It retrieves cryptographic keying material and encrypts victim files using a hybrid encryption scheme involving asymmetric and symmetric cryptography. It targets user data on local systems and mounted volumes, appends a new encrypted-file extension, and drops ransom notes instructing victims to pay for decryption.

KeRanger primarily targets macOS systems and focuses on encrypting a broad range of file types associated with documents, images, archives, source code, databases, certificates, and other user data. It has been described as an early notable macOS ransomware strain and as a variant or rewrite related to Linux.Encoder.1. Apple responded by revoking the abused signing certificate and updating built-in protections, while Transmission replaced the compromised installer with a clean version and issued updates to affected users.