Ankura CTIX FLASH Update - October 25, 2024

Ransomware/Malware Activity

NotLockBit MacOS Ransomware Samples Indicate Emerging Threat

Researchers at SentinelOne and Trend Micro have released analysis on a new ransomware family targeting MacOS from samples uploaded to VirusTotal. As of writing, there has not been a confirmed successful attack leveraging this ransomware in the wild, however the evolution of the ransomware as demonstrated in multiple samples posted in January and May of this year suggests it is in active development. The malware family has been dubbed "NotLockBit", as the final stage of the ransomware updates the wallpaper of the victim machine to a LockBit2.0 banner, however there are no indicators in the malware that it is affiliated with LockBit ransomware, and LockBit2.0 has already been superseded by version 3.0. The malware is written in Go and is distributed as a x86_64 binary, compatible with Intel or Apple silicon Macs with Rosetta emulation software installed. While the malware is