As ransomware gangs look for new ways to improve their execution, this relatively new encryption tactic has been gaining popularity in multiple ransomware families.
If you were a developer of ransomware software, what would your two biggest improvement goals be for your software that help achieve greater success in receiving a ransom payment? I’d guess avoiding detection and a faster encryption speed – all to ensure the maximum amount of data is encrypted before any incident response efforts can take place.
According to the security researchers at Sentinel Labs, a tactic first seen in mid-2021 has been growing in adoption among ransomware gangs. Called Intermittent Encryption, this tactic only encrypts a portion of a file, but just enough to render it useless. There are three modes seen in the wild:
- Skip-Step – this “steps” through and encrypts a certain number of MBs, and then “skips” another number of MBs
- Percent – like Skip-Step, but skipping a percent of the file, rather than a specific number of MBs
- Fast – Encrypts the first X MBs of a file
A number of ransomware families have recently adopted this method, including Qyick, Agenda, BlackCat, PLAY, and Black Basta.
The benefit of using such an encryption method is that it helps achieve the two goals previously mentioned: because it only encrypts a portion of the file, more data can be encrypted in the same amount of time. And because the process is less disk-intensive, it’s less likely to trigger alerts based on disk usage.
The warning here is that, as this method proves to be successful in encrypting more of an environment, more ransomware families will adopt it, making ransomware even more dangerous and it more necessary for organizations to utilize Security Awareness Training to educate users on how to spot social engineering in both web- and email-based attacks attempting to gain entrance into the organization’s network.
Here's how it works:
