S0595: ThiefQuest

ThiefQuest is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. ThiefQuest was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links.[1] Even though ThiefQuest presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.[2][3]

EnterpriseS0595MalwareObject v1.2ModifiedApr 16, 2025, 20:38 UTC (UTC+00:00)

S0595: ThiefQuest describes [ThiefQuest](https://attack.mitre.org/software/S0595) is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. [ThiefQuest](https://attack.mitre.org/software/S0595) was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links.(Citation: Reed thiefquest fake ransom) Even though [ThiefQuest](https://attack.mitre.org/software/S0595) presents itself as ransomware, since the dynamically generated encryption key...

Executive priority

S0595: ThiefQuest is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0595: ThiefQuest by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (macOS), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0595: ThiefQuest appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ThiefQuest

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques18 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1486	Data Encrypted for Impact	ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.[2]
Enterprise	T1071.001	Web ProtocolsSub-technique	ThiefQuest uploads files via unencrypted HTTP. [2][3]
Enterprise	T1564.001	Hidden Files and DirectoriesSub-technique	ThiefQuest hides a copy of itself in the user's `~/Library` directory by using a `.` at the beginning of the file name followed by 9 random characters.Citationwardle evilquest parti
Enterprise	T1056.001	KeyloggingSub-technique	ThiefQuest uses the `CGEventTap` functions to perform keylogging.CitationTrendmicro Evolving ThiefQuest 2020
Enterprise	T1685	Disable or Modify Tools	ThiefQuest uses the function `kill_unwanted` to obtain a list of running processes and kills each process matching a list of security related processes.Citationwardle evilquest parti
Enterprise	T1554	Compromise Host Software Binary	ThiefQuest searches through the `/Users/` folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior. [2][3]
Enterprise	T1543.004	Launch DaemonSub-technique	When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the `/Library/LaunchDaemons/` folder with the `RunAtLoad` key set to `true` establishing persistence as a Launch Daemon. Citationwardle evilquest parti
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.[2][3]
Enterprise	T1041	Exfiltration Over C2 Channel	ThiefQuest exfiltrates targeted file extensions in the `/Users/` folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.[2][3]
Enterprise	T1059.002	AppleScriptSub-technique	ThiefQuest uses AppleScript's `osascript -e` command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon. Citationwardle evilquest parti
Enterprise	T1543.001	Launch AgentSub-technique	ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the `~/Library/LaunchAgents/` folder and configured with the path to the persistent binary located in the `~/Library/` folder.Citationwardle evilquest parti
Enterprise	T1057	Process Discovery	ThiefQuest obtains a list of running processes using the function `kill_unwanted`.Citationwardle evilquest parti
Enterprise	T1620	Reflective Code Loading	ThiefQuest uses various API functions such as `NSCreateObjectFileImageFromMemory` to load and link in-memory payloads.[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	ThiefQuest uses the `kill_unwanted` function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.Citationwardle evilquest parti
Enterprise	T1106	Native API	ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.[2]
Enterprise	T1497.003	Time Based ChecksSub-technique	ThiefQuest invokes `time` call to check the system's time, executes a `sleep` command, invokes a second `time` call, and then compares the time difference between the two `time` calls and the amount of time the system slept to identify the sandbox.Citationwardle evilquest parti
Enterprise	T1622	Debugger Evasion	ThiefQuest uses a function named `is_debugging` to perform anti-debugging logic. The function invokes `sysctl` checking the returned value of `P_TRACED`. ThiefQuest also calls `ptrace` with the `PTRACE_DENY_ATTACH` flag to prevent debugging.[2]
Enterprise	T1105	Ingress Tool Transfer	ThiefQuest can download and execute payloads in-memory or from disk.[2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.2
Created: Mar 19, 2021, 16:26 UTC (UTC+00:00)
Modified: Apr 16, 2025, 20:38 UTC (UTC+00:00)
Raw hash: 485f14dbef710b85...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.2	Apr 16, 2025, 20:38 UTC (UTC+00:00)	Current bundle	`485f14dbef71…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	Apr 16, 2025, 20:38 UTC (UTC+00:00)	Older bundle	`485f14dbef71…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Reed thiefquest fake ransom
Thomas Reed. (2020, July 7). Mac ThiefQuest malware may not be ransomware after all. Retrieved March 18, 2021.
Open source URL
[2]
wardle evilquest partii
Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.
Open source URL
[3]
reed thiefquest ransomware analysis
Thomas Reed. (2020, July 7). Mac ThiefQuest malware may not be ransomware after all. Retrieved March 22, 2021.
Open source URL
[4]
EvilQuest
(Citation: Reed thiefquest fake ransom)
[5]
MacRansom.K
(Citation: SentinelOne EvilQuest Ransomware Spyware 2020)
[6]
SentinelOne EvilQuest Ransomware Spyware 2020
Phil Stokes. (2020, July 8). “EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One. Retrieved April 1, 2021.
Open source URL
[7]
ThiefQuest
(Citation: Reed thiefquest fake ransom)
[8]
mitre-attackS0595
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use