Threat intelligence / Malware

ThiefQuest

[ThiefQuest](https://attack.mitre.org/software/S0595) is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. [ThiefQuest](https://attack.mitre.org/software/S0595) was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links.(Citation: Reed thiefquest fake ransom) Even though [ThiefQuest](https://attack.mitre.org/software/S0595) presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.(Citation: wardle evilquest partii)(Citation: reed thiefquest ransomware analysis)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ThiefQuest](https://attack.mitre.org/software/S0595) is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. [ThiefQuest](https://attack.mitre.org/software/S0595) was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links.(Citation: Reed thiefquest fake ransom) Even though [ThiefQuest](https://attack.mitre.org/software/S0595) presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.(Citation: wardle evilquest partii)(Citation: reed thiefquest ransomware analysis)

Labels

malware

18 recorded

Relationships

uses

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Debugger Evasion

Technique

uses

to Disable or Modify Tools

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Launch Agent

Technique

uses

to Launch Daemon

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Reflective Code Loading

Technique

uses

to Security Software Discovery

Technique

uses

to Time Based Checks

Technique

uses

to Web Protocols

Technique

8 external

References

mitre-attack

S0595

ThiefQuest

—

EvilQuest

—

MacRansom.K

—

wardle evilquest partii

https://objective-see.com/blog/blog_0x60.html

SentinelOne EvilQuest Ransomware Spyware 2020

https://www.sentinelone.com/blog/evilquest-a-new-macos-malware-rolls-ransomware-spyware-and-data-theft-into-one/

Reed thiefquest fake ransom

https://blog.malwarebytes.com/detections/osx-thiefquest/

reed thiefquest ransomware analysis

https://blog.malwarebytes.com/mac/2020/07/mac-thiefquest-malware-may-not-be-ransomware-after-all/