The Rise of Shadow Encryption: Combatting the Next Generation of Ransomware
Pages: 1
Company: Index Engines
Shadow encryption was introduced in July 2021 when the ransomware gang Conti allegedly introduced LockFile. The LockFile ransomware variant used intermittent encryption to encrypt every 16 bytes of a file, leaving the rest unimpacted.This was specifically designed to evade detection by tools that look for obvious signs of encryption through unusual change in data compression rates.
Intermittent encryption changed the game as it was a challenge to detect. Data that was corrupted by LockFile did not generate the “signals” that most tools could detect and alert on. However, the bad actors didn’t stop there. They continued to use technology to improve and advance their arsenals. Data encryption is a common approach to variants in their arsenals.With intermittent encryption being just the start, LockFile became one of the most prominent crime families in the ransomware game. Many took notice of this and continued to embrace shadow encryption and took it to the next level.
Around the same time that LockFile launched the Chaos ransomware variant was introduced. This variant took shadow encryption to the next level and utilized another form of shadow encryption based on Base64 algorithms. Base64 encoding helps conceal the true nature of ransomware corruption. By converting binary data into an ASCII string format, it makes the malicious code less recognizable to security tools and easily goes undetected. This approach deepened the bad actors shadow encryption strategies and generated great success in impacting organizations and forcing them to pay ransoms.
