LockFile Ransomware Bypasses Protection Using Intermittent File Encryption

A new ransomware family members that emerged very last thirty day period will come with its very own bag of tips to bypass ransomware defense by leveraging a novel approach identified as “intermittent encryption.”

Known as LockFile, the operators of the ransomware has been found exploiting just lately disclosed flaws these kinds of as ProxyShell and PetitPotam to compromise Windows servers and deploy file-encrypting malware that scrambles only every alternate 16 bytes of a file, therefore supplying it the ability to evade ransomware defences.

Stack Overflow Teams

“Partial encryption is commonly applied by ransomware operators to pace up the encryption process and we’ve witnessed it implemented by BlackMatter, DarkSide and LockBit 2. ransomware,” Mark Loman, Sophos director of engineering, said in a statement. “What sets LockFile aside is that, unlike the others, it does not encrypt the very first several blocks. In its place, LockFile encrypts each other 16 bytes of a document.”

“This suggests that a file these types of as a text doc remains partially readable and looks statistically like the initial. This trick can be thriving against ransomware safety software package that relies on inspecting content making use of statistical examination to detect encryption,” Loman added.

Sophos’ investigation of LockFile comes from an artifact that was uploaded to VirusTotal on August 22, 2021.

As soon as deposited, the malware also usually takes actions to terminate significant processes related with virtualization software program and databases through the Windows Management Interface (WMI), ahead of proceeding to encrypt important documents and objects and screen a ransomware be aware that bears stylistic similarities with that of LockBit 2..


The ransom observe also urges the victim to make contact with a certain electronic mail deal with “get hold of@contipauper.com,” which Sophos suspects could be a derogatory reference to a competing ransomware team named Conti.

Prevent Ransomware Attacks

What is actually extra, the ransomware deletes itself from the procedure article successful encryption of all the documents on the device, which means that “there is no ransomware binary for incident responders or antivirus software to uncover or cleanse up.”

“The message here for defenders is that the cyberthreat landscape under no circumstances stands nonetheless, and adversaries will promptly seize just about every possible chance or instrument to launch a thriving attack,” Loman claimed.

The disclosure arrives as the U.S. Federal Bureau of Investigation (FBI) launched a Flash report detailing the techniques of a new Ransomware-as-a-Service (RaaS) outfit recognised as Hive, consisting of a selection of actors who are applying various mechanisms to compromise business enterprise networks, exfiltrate facts and encrypt knowledge on the networks, and attempt to obtain a ransom in exchange for accessibility to the decryption software.

Fibo Quantum