LockBit is a Russia-based ransomware gang that emerged at the end of 2019. The group is most known for its sheer volume of attacks, and for appearing well-organized and being less ostentatious and sophomoric than some of its peers in the cybercriminal landscape. But LockBit isn’t immune from arrogance and public aggression. Notably, it called significant attention to itself in recent months by targeting the United Kingdom’s Royal Mail and a Canadian children’s hospital.

For now, Wardle notes that LockBit’s macOS encryptors seem to be in a very early phase and still have fundamental development issues like crashing on launch. And to create truly effective attack tools, LockBit will need to figure out how to circumvent macOS protections, including validity checks that Apple has added in recent years for running new software on Macs.

“In some sense, Apple is ahead of the threat, as recent versions of macOS ship with a myriad of built-in security mechanisms aimed to directly thwart, or at least reduce the impact of, ransomware attacks,” Wardle says. “However, well-funded ransomware groups will continue to evolve their malicious creations.”

Developing Mac ransomware may not be the highest priority on every attacker’s to-do list, but the field is shifting. As law enforcement worldwide pushes to counter attacks, and victims increasingly have input and resources available to avoid paying, ransomware gangs are getting more desperate for new or refined strategies that will help them get paid.

“The LockBit encryptor doesn’t look particularly viable in its current form, but I’m definitely going to be keeping an eye on it,” says Thomas Reed, director of Mac and mobile platforms at the antivirus maker Malwarebytes. “The viability may improve in the future. Or it may not, if their tests aren’t promising.”

Still, for ransomware actors looking to generate as much revenue as possible, Macs are a potentially appealing untilled field.