KeRanger ransomware made headlines as one of the first ransomware threats specifically targeting macOS.
If your Mac has been infected, it’s crucial to act fast to protect your data and restore your system’s security.
This guide will take you through everything you need to know to identify, remove, and prevent KeRanger ransomware.
What is KeRanger Ransomware?
KeRanger is a ransomware that infects your macOS and encrypts your personal files so you can’t access them. Ransomware is known for demanding a payment (usually in cryptocurrency) in exchange for a decryption key to get your files back.
KeRanger is sneaky because it infects your Mac stealthily and waits for 3 days before it starts encrypting files. You don’t even notice it until it has encrypted a lot of files on your Mac.
KeRanger was distributed through a compromised version of the Transmission BitTorrent client. Once installed, it starts a 3-day timer before it starts the encryption process, locks your data, and makes it impossible to recover without paying the ransom.
How Does KeRanger Infect Macs?
KeRanger primarily infected users who downloaded Transmission version 2.90 between March 4 and March 5, 2016. The official download package was compromised, and users who installed this version unknowingly introduced the ransomware to their systems.
This attack demonstrated how even trusted software can become a vehicle for ransomware through supply chain attacks.
Once installed, KeRanger waits for three days before activating, a delay that allows it to avoid immediate detection and secure its foothold on the infected system.
After the timer expires, KeRanger begins encrypting files and appending a “.encrypted” extension, rendering them inaccessible without the decryption key.
The Signs of a KeRanger Infection
Knowing the signs of a KeRanger infection is key to acting fast. Here are the indicators that KeRanger is on your Mac:
- File Extensions Changed: KeRanger encrypts files and adds a “.encrypted” extension. If you see this on your files, it’s a clear sign of ransomware.
- Ransom Note: A file named “README_FOR_DECRYPT.txt” will appear in the directories where your files are encrypted. This file will contain instructions for paying the ransom and a cryptocurrency wallet address to send the payment.
- Unusual System Behavior: KeRanger uses system resources during the encryption process, which can slow down your Mac and make applications unresponsive.
How to Remove KeRanger Ransomware from Mac
Follow these steps to remove KeRanger. Make sure to do each one to remove the ransomware from your system completely.
1. Disconnect from the Internet
The first step to remove KeRanger is to disconnect from the internet.
Ransomware can communicate with external servers, potentially spreading further or receiving instructions. Disconnecting from the internet isolates the malware.
Turn off Wi-Fi or unplug your Ethernet connection. This will prevent KeRanger from communicating with the outside world.
2. Terminate Suspicious Processes
KeRanger operates using specific run. Stopping these processes can halt the ransomware’s activity and prevent further encryption.
- Open Activity Monitor: Go to Applications > Utilities > Activity Monitor.
- Identify Malicious Processes: Look for processes such as “kernel_service,” which is associated with KeRanger.
- Terminate the Process: Select any suspicious process, then click the “X” (stop) button in the toolbar to stop it.
3. Delete Malicious Files
KeRanger may have left malicious files in specific directories. Delete these files and the ransomware won’t be able to re-run.
- Open Finder and navigate to /Applications/Transmission.app/Contents/Resources/.
- Check for files like “General.rtf” or other files created at the time of infection.
- Drag these files to the Trash.
- Empty the Trash to ensure they are permanently removed.
4. Remove Suspicious Launch Agents
Launch Agents are scripts that launch software automatically. KeRanger may install Launch Agents to run even after reboot.
- Go to Finder and select Go > Go to Folder.
- Type
/Library/LaunchAgents/and press Enter. - Look for files named something like “com.apple.iCloud.sync.daemon.plist” or other suspicious names.
- Move pinpointed files to Trash and empty it.
5. Check Your Applications Folder
KeRanger may have installed additional applications to stay on your Mac. To remove these applications:
- Navigate to Applications in Finder.
- Look for unfamiliar apps, especially if installed recently.
- Move any suspicious apps to the Trash.
- Empty the Trash.
6. Restart Your Mac
After removing suspicious files and apps, reboot your Mac to apply all changes. Rebooting will also confirm the ransomware is not running during system startup.
How to Restore Your Encrypted Files
After removing KeRanger, you may still need to restore encrypted files. Unfortunately, without the decryption key, encrypted files are inaccessible, but you can take several steps to restore your data if you have a backup.
1. Use a Backup to Restore Files
If you have a recent backup, you can restore files without paying the ransom. Ensure the backup predates the infection.
- Check Backup Integrity: Confirm that the backup was created before the infection and is malware-free.
- Restore Files: Use Time Machine or another backup tool to recover files to their original state.
2. Try Data Recovery Tools
Although success varies, some data recovery tools may help retrieve data if backups are unavailable. These tools scan your hard drive for recoverable data but may not always work on encrypted files.
How to Avoid Ransomware on Your Mac
To protect your Mac from future ransomware threats, it’s essential to take proactive steps that enhance your device’s security. Here’s how to prevent infections like KeRanger from reoccurring.
- Download from Official Sources: Only download applications from official, reputable sources, like the Mac App Store or verified developer websites. Avoid third-party sites, as they are more susceptible to distributing malware.
- Update Regularly: Updates often include security patches that protect against known vulnerabilities. Make it a habit to keep both macOS and all software up-to-date. Turn on automatic updates in System Settings > General > Software Update to ensure your Mac installs critical security patches.
- Turn on macOS Security Features:
- Gatekeeper: Blocks apps from unidentified developers. You can activate Gatekeeper under System Settings > Security & Privacy.
- XProtect: Automatically scans for known malware in downloads.
- Backup Your Data
- Use Time Machine: Apple’s built-in backup tool makes it easy to restore files after an infection.
- Keep a Separate Backup Drive: Using a dedicated external drive for backups ensures data is isolated from malware on your Mac.
- Be Safe Online: Ransomware spreads through suspicious links and malicious ads. Don’t click on unknown links in emails or on untrusted sites and be careful downloading attachments from unknown sources.
Summary
KeRanger is a wake-up call that macOS is not immune to malware. Follow this guide to remove KeRanger from your Mac and take preventative measures to protect your data from future threats.
Ransomware can be tough to remove, but early detection and quick action will minimize the damage.
Stay vigilant, keep your system updated, and always back up your files to maintain a secure Mac environment.
