KeRanger

KeRanger (also known as OSX.KeRanger.A) is a ransomware trojan horse targeting computers running macOS.

Discovered on March 4, 2016, by Palo Alto Networks, it affected more than 7,000 Mac users.

KeRanger is remotely executed on the victim's computer from a compromised installer for Transmission, a popular BitTorrent client downloaded from the official website.

When the instructions are opened, it gives the victim directions on how to decrypt the files, usually demanding a payment of one bitcoin.

[2] On March 4, 2016, Palo Alto Networks added Ransomeware.KeRanger.OSX to their virus database.

After it was reported, the makers of Transmission issued a new download on the website and pushed out a software update.

Warning issued to Transmission users.
"README_FOR_DECRYPTION.txt" file placed in all folders.