EvilQuestMalware
- macransom.k
- thiefquest
According to PcRisk, EvilQuest (also known as ThiefQuest) is like many other malicious programs of this type - it encrypts files and creates a ransom message. In most cases, this type of malware modifies the names of encrypted files by appending certain extensions, however, this ransomware leaves them unchanged.From MISP Galaxy
Last reported 9 months ago, by Huntress2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“… capability allows us to perform a point-in-time collection mechanism (survey) on a timer to get information about specific actions—scheduled tasks, services, etc.”
- T1553.002Code Signing
“Some of the nuances here from the other platforms include code signing information, such as Developer IDs, that can give visibility into malware attempting to masquerade as legitimate software.”
- T1684Social Engineering
“…ion-state activity, macOS observes items like PUPs, adware like search engine hijacking and clickbait, or Shlayer, which leverages social engineering techniques to get the user to override Gatekeeper to execute.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cross-Platform Unity in EDR“EvilQuest was one of the primary ransomware strains known to target macOS, but the numbers have been completely inflated.”
-
Debunking 5 Major macOS Myths“If we look strictly at VirusTotal, we’d be led to believe that ransomware is running rampant on Macs, namely the EvilQuest/ThiefQuest ransomware, which was first uncovered in mid-2020.”
Thanks — we review every report.