LockBit ransomware group now targeting Macs in their attacks for the first time

LockBit has emerged as one of the most dominant ransomware groups in recent years.

The notorious LockBit ransomware group has made headlines recently for reportedly developing its first ransomware build specifically for Macs. While LockBit is primarily known for targeting Windows, Linux, and virtual host machines, this new development suggests that the group is expanding its reach to target Apple devices as well. The discovery of the Mac ransomware build was made by security researchers from MalwareHunterTeam, who shared their findings on Twitter via cybersecurity expert Brett Callow.

LockBit is a ransomware group that operates using a ransomware-as-a-service (RaaS) business model. This means that they offer their ransomware to other cybercriminals for a fee, allowing anyone to launch ransomware attacks using LockBit's software. The group is believed to be based in Russia, as most of its members are Russian-speaking. However, the group's leader has claimed to operate out of the United States or China.

The Mac ransomware build, which has been identified as "locker_Apple_M1_64," appears to be designed specifically for Apple Silicon Macs. While it's not entirely clear when the ransomware was created, MalwareHunterTeam believes that it may have been around since at least November 2022. Interestingly, a LockBit ransomware build has also been found for PowerPC Macs, indicating that the group is targeting a wide range of Apple devices.

According to Jon DiMaggio, chief security strategist at Analyst1, LockBit's success can be attributed to its leader's business savvy and the group's focus on user experience. The group has developed a point-and-click ransomware tool that is easy for anyone to use, and they regularly update their software based on user feedback. They have also been known to poach members from rival gangs, further consolidating their position as one of the most notorious ransomware groups on the dark web.

While it's unclear how widespread the use of LockBit's Mac ransomware will be, the group's RaaS model means that it's possible we could see an increase in ransomware attacks targeting Apple devices in the future. As always, it's important to stay vigilant and take steps to protect your devices and data from cyber threats.