First real OS X ransomware

We published detection for the known variants of the DMG as well as the binary Mon, 07 Mar 2016 12:19:11 +0000 as part of the IDE "tesla-cj.ide". Its our intention to stay on top of the current variant as well as future variants and publish updates as rapidly as possible. The automatic updating mechanism works pretty well, in this regard.

We published detection for the known variants of the DMG as well as the binary Mon, 07 Mar 2016 12:19:11 +0000 as part of the IDE "tesla-cj.ide". Its our intention to stay on top of the current variant as well as future variants and publish updates as rapidly as possible. The automatic updating mechanism works pretty well, in this regard.

Good to know. Thanks.

It was reported in the wild on 3/4 and your first definitions were created on 3/7.  So, users weren't protected from this for 3 days?

Please keep in mind the timeline of disclosure to friendly security companies only happened on March 6th despite the fact that Apple and the original software vendor for Transmission received notification on March 4th.

Understood.  That's unfortunate.

What about the other 6500 downloads?  None of them were Sophos-protected hosts?  I'm guessing that's a small sample and may not have produced a hit.

Just did a quick run of the threat report analytics. To date, we have seen 47 unique Mac endpoints detecting OSX/KeRanger-A. Not a lot, really, and we strongly suspect those 47 are people testing whether we detect it or not.

And to be really honest, no I have no idea who those endpoints are or even what country they live in. This type of data is heavily anonymized for obvious reasons.