ThiefQuest

Description

ThiefQuest (a.k.a. EvilQuest) is a virus, data stealer, and wiper that presents itself as ransomware on macOS systems. It first appeared in 2020 distributed through trojanized pirated macOS software shared on Russian forums, and because its dynamically generated encryption key is never sent to its operators, it functions more like a wiper than functional ransomware.

Stats

First seen: September 2022
Last seen: October 2026

MITRE ATT&CK techniques

18 techniques across 9 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.002AppleScript
T1106Native API

TA0003 Persistence

T1543Create or Modify System Process
- T1543.004Launch Daemon
- T1543.001Launch Agent
T1554Compromise Host Software Binary

TA0005 Stealth

T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks
T1564Hide Artifacts
- T1564.001Hidden Files and Directories
T1620Reflective Code Loading
T1622Debugger Evasion

TA0007 Discovery

T1057Process Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1056Input Capture
- T1056.001Keylogging

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0040 Impact

T1486Data Encrypted for Impact

TA0112 Defense Impairment

T1685Disable or Modify Tools

Alert name variants

Alert Name	Engine
Gen:Variant.Trojan.MAC.EvilQuest.1	AV
MacOS.Ransomware.EvilQuest	ATP Sandbox Adv. Heuristics
MacOS.Trojan.EvilQuest	ATP Sandbox Adv. Heuristics
Trojan.MAC.EvilQuest.A	AV
Trojan.MAC.EvilQuest.B	AV
Trojan.MAC.Ransom.EvilQuest.A	AV
Trojan.MAC.Ransom.EvilQuest.B	AV
Trojan.MAC.Ransom.EvilQuest.K	AV
Trojan.MAC.Ransom.EvilQuest.L	AV

Related families

DarkGate PlugX QakBot Carberp Grandoreiro