This weekend was the first time that ransomware successfully made victims running Apple's Mac OS X. Security experts of Palo Alto Networks discovered that the popular free BitTorrent client Transmission was infected with KeRanger ransomware.
The ransomware was part of Transmission 2.90 and waits 3 days until it starts to encrypted files. To decrypt the files the cybercriminals behind the ransomware demand 1 Bitcoin, currently worth about $400. The OSX.KeRanger.A ransomware also tries to encrypt Time Machine files, so victims can't restore a backup.
It's unclear how the KeRanger ransomware ended up in the Transmission version. The attack was pretty sophisticated, the criminals e.g. used security certificates approved by Apple which allowed the ransomware to infect Macs. Apple immediately took action and revoked the affected certificates.
Also Transmission quickly released a new -ransomware free- version, version 2.92 is no longer infected. It's the first time ransomware has hit Mac OS X. Previously the OS was considered to be relatively safe from malware. Because the OS has a small user base, cybercriminals used to target mainly Windows because they could make much more victims.
