S0595 ThiefQuest

malwareEnterprise

platformsmacOS

also known asThiefQuest · MacRansom.K · EvilQuest

ThiefQuest is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. ThiefQuest was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links. Even though ThiefQuest presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1036.005Match Legitimate Resource Name or Location
T1041Exfiltration Over C2 Channel
T1056.001Keylogging
T1057Process Discovery
T1059.002AppleScript
T1071.001Web Protocols
T1105Ingress Tool Transfer
T1106Native API
T1486Data Encrypted for Impact
T1497.003Time Based Checks
T1518.001Security Software Discovery
T1543.001Launch Agent
T1543.004Launch Daemon
T1554Compromise Host Software Binary
T1564.001Hidden Files and Directories
T1620Reflective Code Loading
T1622Debugger Evasion
T1685Disable or Modify Tools

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan