NotLockBit MacOS Ransomware Samples Indicate Emerging Threat

Researchers at SentinelOne and Trend Micro have released analysis on a new ransomware family targeting MacOS from samples uploaded to VirusTotal. As of writing, there has not been a confirmed successful attack leveraging this ransomware in the wild, however the evolution of the ransomware as demonstrated in multiple samples posted in January and May of this year suggests it is in active development. The malware family has been dubbed “NotLockBit”, as the final stage of the ransomware updates the wallpaper of the victim machine to a LockBit2.0 banner, however there are no indicators in the malware that it is affiliated with LockBit ransomware, and LockBit2.0 has already been superseded by version 3.0. The malware is written in Go and is distributed as a x86_64 binary, compatible with Intel or Apple silicon Macs with Rosetta emulation software installed. While the malware is currently in a Proof of Concept (POC) stage, it already includes infrastructure for exfiltrating and storing victim data, using hard-coded AWS credentials to exfiltrate data to attacker-controlled AWS S3 buckets. The ransomware uses RSA asymmetric key encryption, using the public key to encrypt a random master key generated for each file used for its subsequent encryption. Encrypted files are updated with a “.abcd” file extension, and a README.txt file is left in each compromised folder. It is important to note that victims would still need to allow the malware to run by accepting warnings raised by Apple’s TCC protections. However, TCC bypassing techniques do exist, and it’s likely that a future version of the malware would include a feature to bypass this. The discovery of these malware samples signifies an emerging threat of ransomware against MacOS devices. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.