KeRanger ransomware is a malicious program that targets Mac computers and encrypts files, making them inaccessible. It is one of the first successful ransomware attacks against the Mac OSX operating system on a relatively broad scale. KeRanger is distributed through the Transmission BitTorrent client, and once it infiltrates a system, it encrypts all stored files.
Table of Contents
What is KeRanger Ransomware
KeRanger ransomware is an open-source virus that was injected into the legitimate BitTorrent Client called Transmission in 2016. It encrypts files with 2048-bit RSA encryption, adding a ".encrypted" extension to each one, and demands a ransom of 1 Bitcoin for decryption software. Victims are provided with detailed payment instructions in the README_FOR_DECRYPT.txt file, as well as a free decryption of one selected file and support service to answer any questions related to payments. Apple has since revoked the compromised certificate and updated XProtect antivirus signatures, and transmissionbt.com has removed malicious installers from their website and issued a warning to users.
How KeRanger Ransomware Infects Your Mac
KeRanger ransomware drops an executable file disguised as General.rtf, which initiates the encryption process and adds a new ".encrypted" extension to the files. The executable may come from suspicious emails and websites or as malware disguised in a software update. Victims are then asked to pay 1 BTC in order to get a decryption program. However, there is currently no way to decrypt the files without paying the ransom.
A Sequel to Keydnap Ransomware and a Prequel to Many More
Although KeRanger's association with the Transmission Bittorrent client, it wasn't the first ransomware threat exploiting it. That honor belongs to the infamous Keydnap Ransomware, which accessed user data stored in their Keychain. Mobile devices have also been targeted by ransomware since 2014, locking devices and demanding payment to unlock them again. Cybercriminals quickly realized the potential of ransomware against businesses, resulting in data and revenue losses. By 2017, 35 percent of small and medium-sized businesses had experienced a ransomware attack. In 2020, amidst the global COVID pandemic, these attacks persisted, with hospitals and medical facilities being targeted by ransomware gangs who developed new tactics such as "double extortion." These groups even offered their services to other criminals so they could launch their own attacks.
KeRanger Ransomware Removal
Ransomware is a malicious software that encrypts data on a computer or on a network of systems, making it inaccessible to the user. It is one of the most common cyber threats today and can have devastating consequences if not dealt with properly, and KeRanger makes no exception, either. Fortunately, a reputable anti-malware tool (such as SpyHunter for Mac) may help users to weather the storm in the event of an attack. Additionally, individuals can protect themselves from ransomware attacks by regularly backing up their data and using anti-malware software as well as data recovery tools.
Like other ransomware and malware threats on a Mac computer, simply deleting the icon or singular file of the threat or malicious application will not eliminate it completely. Mac computer users are recommended by computer security experts to utilize the proper resources to find and remove all elements of such a threat, which can be done automatically using an updated anti-malware program through its scan and removal processes.
How to Protect Your Mac or PC from Similar Malware Threats in the Future
To prevent a KeRanger Ransomware infection, users should be aware of suspicious emails and websites, keep their software up-to-date, and use anti-virus or anti-malware software. Even if KeRanger has already loaded and caused system damage through file encryption, you can still apply a removal method through the use of an anti-malware application to ultimately stop the encryption process.
To mitigate and lessen the damage of future ransomware attacks, it is important to not only invest in good cybersecurity software with real-time protection, but all computer users should create secure backups of data on a regular basis, keep systems and software up to date, and stay informed of any potential threats. Additionally, because Mac computers are nearly as susceptible to ransomware attacks as Windows PCs, it is important to also run a robust anti-malware application at all times to help protect MacOS systems from ransomware. Using an anti-malware program with the proper capabilities and system monitoring is essential to proactively detect system processes or threats that may encrypt files.
Data Backups are Absolutely Essential to Recover Files Lost from a Ransomware Attack
With KeRanger being one of the most serious threats to personal data security, it is important to take the necessary precautions in the event that such a threat causes irreversible damage to files. Once KeRanger is installed on a machine, it applies sophisticated encryption algorithms to lock all of your files, although it does not delete them. Sadly, It is a common misconception that anti-malware software can restore your files to their previous states. While such software may certainly help you to prevent further damage, it cannot undo the damage that has already been done. Therefore, your data would remain locked even after the malicious payload has been deleted. The only assured way to recover your files after a ransomware attack is to have regular data backups of your computer. If you are lucky, an automated decryptor might succeed in restoring your access, which is a very rare circumstance. However, it is not recommended to pay the ransom as there is no guarantee you will receive the right decryption key and you risk putting your bank credentials at risk. Performing regular system backups will ensure that you have recent files available to restore to your system in the event that a threat like KeRanger wipes them out through encryption.
