Microsoft has revealed the tactics used by KeRanger, FileCoder, MacRansom, and EvilQuest, all targeting macOS systems.