Catching Mac Ransomware With Math Instead of AI: Patrick Wardle at VB2026
Nearly every ransomware strain does the same thing. It rapidly turns a user's files into encrypted data, and that behavior can be measured.
Macs keep spreading through the enterprise, and ransomware authors have noticed. Signature-based tools miss new strains, while machine learning can be opaque and heavy.
Patrick Wardle argued for a third path that is lightweight and explainable.
In his VB2026 talk, "Practical ransomware detection on macOS (via maths, not AI)", on Friday, October 16, Patrick Wardle showed how to catch ransomware generically with math.
Speaker: Patrick Wardle, Cofounder, Objective-See Foundation
The approach uses Apple's Endpoint Security framework to watch file activity. Entropy analysis then separates ordinary file writes from encryption.
Simple heuristics tell encrypted data apart from compressed data, which is the classic source of false positives.
The talk walked through the implementation in a free, open-source tool. It included real-world testing and a demo against macOS ransomware samples.
Wardle also covered the method's limits and possible evasions. Slow or dormant encryption remains the hardest case.
For defenders, the takeaway is that behavior-based detection does not need a black box. A few well-chosen measurements can stop ransomware before most files are lost.
Patrick Wardle founded the nonprofit Objective-See Foundation, which publishes free macOS security tools, and the Objective by the Sea conference. He is also CEO and cofounder of DoubleYou, as well as author of The Art of Mac Malware.
He previously worked at NASA and the NSA. He later served as a principal security researcher at Jamf and chief security researcher at Synack.
To go deeper on the topic, start here:
- Video: Wardle at #OBTS v8.0, "Dylib Hijacking on macOS: Dead or Alive?", on related macOS detection work.
- Podcast: MacAdmins Podcast, "Patrick Wardle on iOS Security".
- Tool: RansomWhere?, Objective-See's free entropy-based ransomware blocker, with source on GitHub.
- Coverage: SecurityWeek on the original 2016 release of the generic Mac ransomware detector, tested against KeRanger.
- Research: Objective-See on Apple adding TCC events to Endpoint Security, background on the framework the tool builds on.
Mac admins and detection engineers who want ransomware protection they can actually explain should look at this approach.
Would you trust an entropy-based detector to suspend processes on your Mac fleet?
3 points · 1 comment
Mentions
@patrickwardle any chance you can take a look? KnockKnock#58
@objective_see Get LuLu here objective-see/lulu
LuLu is a free, open-source firewall for macOS. It asks you the first time an app tries to make an outbound connection, which is a quick way to find out how many of your apps phone home. New release this week. objective-see/LuLu
@1man_de برای مک میتونید از lulu هم استفاده کنید. github.com/objective-see/LuLu/releases
We've also added a HeartBreaker sample and its metamorphic framework to our public macOS malware repository: github.com/objective-see/Malware/blob/main/HeartB… (pw: infect3d) #SharingIsCaring
Catching Mac Ransomware With Math Instead of AI: Patrick Wardle at VB2026 Nearly every ransomware strain does the same thing. It rapidly turns a user's files into encrypted data, and that behavior can be measured. Macs keep spreading through the enterprise, and ransomware authors have noticed. Signature-based tools miss new strains, while machine learning can be opaque and heavy. Patrick Wardle argued for a third path that is lightweight and explainable. In his VB2026 talk, "Practical ransomware detection on macOS (via maths, not AI)", on Friday, October 16, Patrick Wardle showed how to catch ransomware generically with math. Speaker: Patrick Wardle, Cofounder, Objective-See Foundation The approach uses Apple's Endpoint Security framework to watch file activity. Entropy analysis then separates ordinary file writes from encryption. Simple heuristics tell encrypted data apart from compressed data, which is the classic source of false positives. The talk walked through the implementation in a free, open-source tool. It included real-world testing and a demo against macOS ransomware samples. Wardle also covered the method's limits and possible evasions. Slow or dormant encryption remains the hardest case. For defenders, the takeaway is that behavior-based detection does not need a black box. A few well-chosen measurements can stop ransomware before most files are lost. Patrick Wardle founded the nonprofit Objective-See Foundation, which publishes free macOS security tools, and the Objective by the Sea conference. He is also CEO and cofounder of DoubleYou, as well as author of The Art of Mac Malware. He previously worked at NASA and the NSA. He later served as a principal security researcher at Jamf and chief security researcher at Synack. To go deeper on the topic, start here: - Video: Wardle at #OBTS v8.0, "Dylib Hijacking on macOS: Dead or Alive?", on related macOS detection work. - Podcast: MacAdmins Podcast, "Patrick Wardle on iOS Security". - Tool: RansomWhere?, Objective-See's free entropy-based ransomware blocker, with source on GitHub. - Coverage: SecurityWeek on the original 2016 release of the generic Mac ransomware detector, tested against KeRanger. - Research: Objective-See on Apple adding TCC events to Endpoint Security, background on the framework the tool builds on. Mac admins and detection engineers who want ransomware protection they can actually explain should look at this approach. Would you trust an entropy-based detector to suspend processes on your Mac fleet?
Lulu is also very good as well! objective-see/lulu