(Reuters) - The first known ransomware attack on Apple Inc’s (AAPL.O) Mac computers, which was discovered over the weekend, was downloaded more than 6,000 times before the threat was contained, according to a developer whose product was tainted with the malicious software. 
 
 Hackers infected Macs with the “KeRanger” ransomware through a tainted copy of Transmission, a popular program for transferring data through the BitTorrent peer-to-peer file sharing network. 
 
 So-called ransomware is a type of malicious software that restricts access to a computer system in some way and demands the user pay a ransom to the malware operators to remove the restriction. 
 
 KeRanger, which locks data on Macs so users cannot access it, was downloaded about 6,500 times before Apple and developers were able to thwart the threat, said John Clay, a representative for the open-source Transmission project. 
 
 That is small compared to the number of ransomware attacks on computers running Microsoft Corp’s (MSFT.O) Windows operating system. Cyber security firm Symantec Corp (SYMC.O) observed some 8.8 million attacks in 2014 alone. 
 
 Still, cyber security experts said they expect to see more attacks on Macs as the KeRanger hackers and other groups look for new ways to infect Mac computers. 
 
 An Apple iPhone is pictured next to the logo of Apple in Bordeaux, southwestern France, February 26, 2016. REUTERS/Regis Duvignau 
 
 “It’s a small number but these things always start small and ramp up huge,” said Fidelis Cybersecurity threat systems manager John Bambenek. “There’s a lot of Mac users out there and a lot of money to be made.” 
 
 Symantec, which sells anti-virus software for Macs, warned on its blog that “Mac users should not be complacent.” The post offered tips on protecting against ransomware. (symc.ly/1puolix) 
 
 The Transmission project provided few details about how the attack was launched. 
 
 “The normal disk image (was) replaced by the compromised one” after the project’s main server was hacked, said Clay. 
 
 He added that “security on the server has since been increased” and that the group was in “frequent contact” with Apple as well as Palo Alto Networks, which discovered the ransomware on Friday and immediately notified Apple and Transmission. 
 
 An Apple representative said the company quickly took steps over the weekend to prevent further infections by revoking a digital certificate that enabled the rogue software to install on Macs. 
 
 Transmission responded by removing the malicious 2.90 version of its software from its website (www.transmissionbt.com). On Sunday, it released version 2.92, which its website says automatically removes the ransomware from infected Macs. 
 
 Forbes earlier reported on the number of KeRanger downloads, citing Clay. ||||| Josh Miller/CNET 
 
 Sorry, Mac fans. Now you're no better off than regular old PC users. 
 
 Security researchers have discovered what they believe to be the first-ever ransomware attack targeted at Apple users that actually made it out "into the wild," meaning it's a genuine threat. And in bad news for downloading fiends, it's being spread through torrenting software. 
 
 The problem was first detected Friday, when a team of researchers at Palo Alto Networks found a popular BitTorrent client for Apple's OS X software for Macs that was infected with the ransomware, which they have dubbed "KeRanger." The BitTorrent software in question is Transmission, which Mac users can install on Apple's OS X operating system and then use to access shared files in so-called torrent swarms (which, let's not lie, is usually pirated content). 
 
 It's not the very first time Mac-targeting ransomware has been detected by security experts. In 2014, Kaspersky Labs discovered such software, though it wasn't complete at the time. 
 
 KeRanger, by contrast, marks the arrival of truly dangerous ransomware on the OS X platform. 
 
 "This is the first one in the wild that is definitely functional, encrypts your files and seeks a ransom," Palo Alto Threat Intelligence Director Ryan Olson told Reuters on Sunday. 
 
 Now playing: Watch this: The horror! Mac users must beware of ransomware (like... 
 
 It's an unwelcome arrival for Apple fans, who have long heralded the Mac as an untouchable rival to Windows PCs. While PCs periodically make headlines for being targeted with viruses, malware and any number of digital infections, Mac users have largely been able to avoid serious antivirus talk. Until now. 
 
 The stakes are high with KeRanger. Ransomware is designed to infect a computer and then put the owner in a bind, locking up files or functionality and essentially bricking the device until the user pays to have the problem neutralized. This particular piece of ransomware brings with it a $400 ransom note. 
 
 If a user installed one of the infected versions of Transmission, an executable file embedded within the software would run on the system. At first, there'd be no sign of a problem. But after three days, KeRanger would connect with servers over the anonymous Tor network and begin encrypting certain files on the Mac's system. 
 
 "After completing the encryption process, KeRanger demands that victims pay one bitcoin (about $400) to a specific address to retrieve their files," the researchers wrote in their findings. "Additionally, KeRanger appears to still be under active development and it seems the malware is also attempting to encrypt Time Machine backup files to prevent victims from recovering their back-up data." 
 
 The Palo Alto Networks team notified both Apple and the Transmission Project on March 4. Since then, they say Apple has revoked the security certificate exploited by KeRanger and updated its XProtect antivirus software. Apple declined to comment for this story. 
 
 The researches also note that Transmission has removed the affected versions of the BitTorrent installer from its website. 
 
 If you directly downloaded the Transmission installer from the official website on March 4-5, 2016, you may have been infected by KeRanger. Even if you downloaded it elsewhere or at another time, Palo Alto Network's security experts advise taking extra precautions. Head to their website to find out how to protect yourself. 
 
 Transmission is also recommending users should immediately upgrade to and run the latest version of its software, version 2.92, to ensure KeRanger is "correctly removed" if it is present on a user's Mac. 
 
 
 
 But how did KeRanger make it past the security guards in the first place? 
 
 According to Palo Alto Networks, "the KeRanger application was signed with a valid Mac app development certificate; therefore, it was able to bypass Apple's Gatekeeper protection." 
 
 Because Transmission is by its own admission an open-source, volunteer-based project, researchers also argue that it's possible the project's official website "was compromised and the files were replaced by re-compiled malicious versions." But even then, the Palo Alto Networks team say they can't confirm how the infection occurred. 
 
 The problem might be resolved now, but the incident will no doubt have ripple effects beyond those Mac users that like to dabble in the occasional torrent. 
 
 With the first piece of ransomware now found in the wild, the Mac may no longer maintain its reputation as a bastion of security untouched by the virus concerns of its Windows rivals. Now that the citadel has been breached, there may be plenty of people asking just how strong the walls really are. ||||| On March 4, we detected that the Transmission BitTorrent client installer for OS X was infected with ransomware, just a few hours after installers were initially posted. We have named this Ransomware “KeRanger.” The only previous ransomware for OS X we are aware of is FileCoder, discovered by Kaspersky Lab in 2014. As FileCoder was incomplete at the time of its discovery, we believe KeRanger is the first fully functional ransomware seen on the OS X platform. 
 
 Attackers infected two installers of Transmission version 2.90 with KeRanger on the morning of March 4. When we identified the issue, the infected DMG files were still available for downloading from the Transmission site (hxxps://download.transmissionbt.com/files/Transmission-2.90[.]dmg) Transmission is an open source project. It’s possible that Transmission’s official website was compromised and the files were replaced by re-compiled malicious versions, but we can’t confirm how this infection occurred. 
 
 Figure 1 KeRanger hosted in Transmission’s official website 
 
 The KeRanger application was signed with a valid Mac app development certificate; therefore, it was able to bypass Apple’s Gatekeeper protection. If a user installs the infected apps, an embedded executable file is run on the system. KeRanger then waits for for three days before connecting with command and control (C2) servers over the Tor anonymizer network. The malware then begins encrypting certain types of document and data files on the system. After completing the encryption process, KeRanger demands that victims pay one bitcoin (about $400) to a specific address to retrieve their files. Additionally, KeRanger appears to still be under active development and it seems the malware is also attempting to encrypt Time Machine backup files to prevent victims from recovering their back-up data. 
 
 Palo Alto Networks reported the ransomware issue to the Transmission Project and to Apple on March 4. Apple has since revoked the abused certificate and updated XProtect antivirus signature, and Transmission Project has removed the malicious installers from its website. Palo Alto Networks has also updated URL filtering and Threat Prevention to stop KeRanger from impacting systems. 
 
 Technical Analysis 
 
 The two KeRanger infected Transmission installers were signed with a legitimate certificate issued by Apple. The developer listed this certificate is a Turkish company with the ID Z7276PX673, which was different from the developer ID used to sign previous versions of the Transmission installer. In the code signing information, we found that these installers were generated and signed on the morning of March 4. 
 
 Figure 2 Code signing information of KeRanger 
 
 The KeRanger infected Transmission installers include an extra file named General.rtf in the Transmission.app/Contents/Resources directory. It uses an icon that looks like a normal RTF file but is actually a Mach-O format executable file packed with UPX 3.91. When users click these infected apps, their bundle executable Transmission.app/Content/MacOS/Transmission will copy this General.rtf file to ~/Library/kernel_service and execute this “kernel_service” before any user interface appearing. 
 
 Figure 3 The malicious executable pretends to be an RTF document 
 
 Figure 4 KeRanger executes the extra General.rtf file 
 
 After unpacking the General.rtf with UPX, we determined that its main behavior is to encrypt the user’s files and hold them for ransom. 
 
 The first time it executes, KeRanger will create three files “.kernel_pid”, “.kernel_time” and “.kernel_complete” under ~/Library directory and write the current time to “.kernel_time”. It will then sleep for three days. Note that, in a different sample of KeRanger we discovered, the malware also sleeps for three days, but also makes requests to the C2 server every five minutes. 
 
 Figure 5 KeRanger sleeps for three days before fully executing 
 
 The General.rtf will collect infected Mac’s model name and UUID, upload the information to one of its C2 servers. These servers’ domains are all sub-domains of onion[.]link or onion[.]nu, two domains that host servers only accessible over the Tor network. 
 
 The executable will keep trying to connect with the C2 server until it respond with two lines of encoded data. After decoding these two lines using Base64, the first line contains an RSA public key and the second line is written to files named “README_FOR_DECRYPT.txt.” 
 
 Figure 6 Connect with C2 server and get instructions 
 
 When we were analyzing the samples, the C2 server returned the data for the README_FOR_DECRYPT.txt shown in following picture. It asks victims to pay exactly one bitcoin (currently around $400) through a specific Tor network website to decrypt the files. The website will then guide victims to buy a bitcoin from somewhere else and transfer to the attacker at the address of “1PGAUBqHNcwSHYKnpHgzCrPkyxNxvsmEof”. 
 
 Figure 7 README file ask victim to pay Bitcoin 
 
 Figure 8 Tor website to transfer bitcoin and get decryption pack 
 
 After connecting to the C2 server and retrieving an encryption key, the executable will traverse the “/Users” and “/Volumes” directories, encrypt all files under “/Users”, and encrypt all files under “/Volumes” which have certain file extensions. 
 
 There are 300 different extensions specified by the malware, including: 
 
 Documents: .doc, .docx, .docm, .dot, .dotm, .ppt, .pptx, .pptm, .pot, .potx, .potm, .pps, .ppsm, .ppsx, .xls, .xlsx, .xlsm, .xlt, .xltm, .xltx, .txt, .csv, .rtf, .tex 
 
 Images: .jpg, .jpeg, 
 
 Audio and video: .mp3, .mp4, .avi, .mpg, .wav, .flac 
 
 Archives: .zip, .rar., .tar, .gzip 
 
 Source code: .cpp, .asp, .csh, .class, .java, .lua 
 
 Database: .db, .sql 
 
 Email: .eml 
 
 Certificate: .pem 
 
 Figure 9 Encrypt all files under “/Users” and all specific files under “/Volumes” 
 
 KeRanger statically linked an open source encryption library named mbed TLS (formerly PolarSSL). 
 
 As KeRanger encrypts each file (i.e. Test.docx) starts by creating an encrypted version that uses the .encrypted extension (i.e. Test.docx.encrypted.) To encrypt each file, KeRanger starts by generating a random number (RN) and encrypts the RN with the RSA key retrieved from the C2 server using the RSA algorithm. It then stores the encrypted RN at the beginning of resulting file. Next, it will generate an Initialization Vector (IV) using the original file’s contents and store the IV inside the resulting file. After that, it will mix the RN and the IV to generate an AES encryption key. Finally, it will use this AES key to the contents of the original file and write all encrypted data to the result file. 
 
 Figure 10 Encrypt each file’s content by AES 
 
 In addition to this behavior, it seems like KeRanger is still under development. There are some apparent functions named “_create_tcp_socket”, “_execute_cmd” and “_encrypt_timemachine”. Some of them have been finished but are not used in current samples. Our analysis suggests the attacker may be trying to develop backdoor functionality and encrypt Time Machine backup files as well. If these backup files are encrypted, victims would not be able to recover their damaged files using Time Machine. 
 
 Figure 11 Function “_encrypt_timemachine” is implemented but not used yet 
 
 Mitigations 
 
 We reported the issue to the Transmission Project and to Apple immediately after we identified it. Apple has since revoked the abused certificate, and Gatekeeper will now block the malicious installers. Apple has also updated XProtect signatures to cover the family, and the signature has been automatically updated to all Mac computers now. As of March 5, Transmission Project has removed the malicious installers from its website. 
 
 We have also updated URL filtering and Threat Prevention to stop KeRanger from impacting Palo Alto Networks customers. 
 
 How to Protect Yourself 
 
 Users who have directly downloaded Transmission installer from official website after 11:00am PST, March 4, 2016 and before 7:00pm PST, March 5, 2016, may be been infected by KeRanger. If the Transmission installer was downloaded earlier or downloaded from any third party websites, we also suggest users perform the following security checks. Users of older versions of Transmission do not appear to be affected as of now. 
 
 We suggest users take the following steps to identify and remove KeRanger holds their files for ransom: 
 
 Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them. 
 
 Figure 12 The malicious “kernel_service” process 
 
 Since Apple has revoked the abused certificate and has updated XProtect signatures, if a user tries to open a known infected version of Transmission, a warning dialog will be shown that states “Transmission.app will damage your computer. You should move it to the Trash.” Or “Transmission can’t be opened. You should eject the disk image.” In any case if you see these warnings, we suggest to follow Apple’s instruction to avoid being affected. 
 
 Figure 13 OS X system prevent user to open the infected installer 
 
 Acknowledgements 
 
 We greatly thank Yi Ren, Yuchen Zhou, Jack Wang, Jun Wang from Palo Alto Networks for helping to analyze KeRanger and protect our customers in a timely fashion. Thanks to Richard Wartell, Ryan Olson and Chad Berndtson from Palo Alto Networks for their assistance during the analysis and reporting. 
 
 IOCs 
 
 Samples of Ransomware.OSX.KeRanger 
 
 d1ac55a4e610380f0ab239fcc1c5f5a42722e8ee1554cba8074bbae4a5f6dbe1 Transmission-2.90.dmg 
 
 e3ad733cea9eba29e86610050c1a15592e6c77820927b9edeb77310975393574 Transmission 
 
 31b6adb633cff2a0f34cefd2a218097f3a9a8176c9363cc70fe41fe02af810b9 General.rtf 
 
 d7d765b1ddd235a57a2d13bd065f293a7469594c7e13ea7700e55501206a09b5 Transmission 
 
 2.90.dmg 
 
 ddc3dbee2a8ea9d8ed93f0843400653a89350612f2914868485476a847c6484a Transmission 
 
 6061a554f5997a43c91f49f8aaf40c80a3f547fc6187bee57cd5573641fcf153 General.rtf 
 
 Domains 
 
 lclebb6kvohlkcml.onion[.]link 
 
 lclebb6kvohlkcml.onion[.]nu 
 
 bmacyzmea723xyaz.onion[.]link 
 
 bmacyzmea723xyaz.onion[.]nu 
 
 nejdtkok7oz5kjoc.onion[.]link 
 
 nejdtkok7oz5kjoc.onion[.]nu
– Apple users are no longer immune to the "ransomware" that has attacked PC users in recent years, locking their files or freezing their computers and demanding payment. Security researchers say a tainted version of a torrenting program called Transmission appears to have spread the "KeRanger" malware to Mac users over the weekend. "This is the first one in the wild that is definitely functional, encrypts your files, and seeks a ransom," the threat intelligence director at Palo Alto Networks tells Reuters. Researchers say that KeRanger is silent for the first few days that a computer is infected and then encrypts files, demanding one bitcoin—around $400—to retrieve them, CNET reports. Palo Alto Networks, which first spotted the problem, says on its website that users who downloaded the Transmission installer from the official website between 11:00am PST on March 4 and 7:00pm PST on March 5 are definitely at risk of KeRanger infection, while those who downloaded the program earlier from third-party websites may also be at risk. The group notes that KeRanger appears to be a work still in progress, with functions still under development, including the capacity to stop victims from using Time Machine to recover files attacked by the malware. (A Hollywood hospital coughed up $17,000 when its systems were infected by ransomware.)