Netskope Threat Labs

KeRanger

ATP Sandbox Adv. Heuristics

KeRanger was the first functioning ransomware observed in the wild for macOS, discovered in 2016 distributed through a trojanized installer for the Transmission BitTorrent client. The incident showed that Mac users faced the same extortion risks as Windows users.

First seen
August 2022
Last seen
October 2026
Alert Name
MacOS.Ransomware.KeRanger