Stay Ahead of Ransomware: The Evolution from Encryption to Extortion

On the July episode of the SANS Stay Ahead of Ransomware livestream, we explored a significant shift in the threat landscape: ransomware operators are increasingly abandoning encryption in favor of data theft and extortion-only attacks. Joined by special guest Jamie Tolles from IDX, who brought to the discussion over 15 years of incident response experience and hundreds of ransomware cases, we examined the techniques threat actors are using to bypass traditional security controls and what defenders can do about it. Jamie went through several demos, so make sure and watch the livestream to see them!

The Decline of Encryption-Based Ransomware

The ransomware landscape is undergoing a fundamental transformation. According to a 2025 Sophos study, encryption events have dropped to approximately 50% of cases. Several factors are driving this shift:

• Declining Ransom Payments: Only about 20% of cases now result in payment.
• Improved Backup Capabilities: Organizations have gotten significantly better at recovering from backups, with 97% of organizations with encrypted data now able to recover.
• Insurance Industry Changes: Cyber insurance providers have implemented stricter requirements, such as including mandatory EDR deployment, before issuing policies.
• Payment Disappointments: Victims who paid often discovered they couldn't recover 100% of their data, particularly for virtual machines and databases.

We discussed how even organizations that paid ransoms frequently found the experience unsatisfying. Decryption was slow, data recovery incomplete, and the promised quick return to operations doesn’t happen.

Demo 1: Bypassing MFA with Attacker-in-the-Middle Techniques

Jamie demonstrated how threat actors use tools like Evilginx to bypass multi-factor authentication through session token theft. The attack flow is as follows:

1. A user receives a convincing phishing email with a link to a lookalike login page.
2. The user enters credentials and completes MFA as normal.
3. The attacker captures the authenticated session cookie.
4. Using a browser cookie editor, the attacker imports the stolen cookie and gains full access, with no MFA required.

The key takeaway? Standard MFA, while still recommended, is no longer sufficient. Organizations should implement phishing-resistant MFA using FIDO2-compliant hardware tokens that verify the authenticity of the domain before authentication.

Demo 2: Killing EDR with Vulnerable Drivers

The second demonstration showcased Bring Your Own Vulnerable Driver (BYOVD) attacks, where threat actors leverage legitimate but vulnerable signed drivers to gain kernel-level access and terminate security tools. The attack proceeds as follows:

1. The attacker loads a signed but vulnerable driver onto the system.
2. The driver's vulnerability is exploited to gain kernel access.
3. From kernel mode, the attacker can identify and terminate processes, including EDR agents.
4. With security tooling disabled, the attacker proceeds with credential dumping, data exfiltration, or other objectives.

Jamie demonstrated this against Lima Charlie, but the technique works against other EDRs as well. Once executed, the EDR console may show something such as "disconnected," leaving defenders blind.

Detection opportunities include:

• Monitoring for vulnerable driver loading using resources like [LOLDrivers.io], which tracks known exploitable drivers.
• Alerting on EDR agent disconnections, particularly for servers where disconnections should be rare.
• Correlating EDR telemetry gaps with other data sources that might still be reporting.
• Looking for the service creation and .sys file loading that precedes EDR termination.

Ryan shared his DEF CON workshop on EDR killers for those wanting a deeper technical dive into these techniques.

Demo 3: Data Exfiltration with Rclone

With encryption becoming less common, data theft has taken center stage. Jamie demonstrated Rclone, a legitimate cloud synchronization tool that threat actors have adopted for rapid data exfiltration. Rclone is fast, supports numerous cloud storage providers, and leaves several forensic artifacts:

• Configuration files (rclone.conf): Contains destination URLs and access keys.
• Prefetch files: Provide execution timestamps.
• Sysmon logs: Capture full command-line arguments if Event ID 1 logging is enabled.
• SRUM database: Records network activity and data transfer volumes. Helpful when firewall logs aren't available.

Detection tips:

• Hunt for Rclone execution, but be aware that developers legitimately use it.
• Look for renamed Rclone executables by comparing the process name against the Original Filename in the PE header's version info (threat actors rarely modify this).
• Monitor for Rclone configuration files appearing in unusual locations.

Ryan noted that while Rclone config passwords appear encrypted, they're actually only obfuscated and can be easily decrypted using available tools.

The Backup Conversation: 3-2-1-1-0

The discussion turned to backup strategies, with Ryan emphasizing the modern 3-2-1-1-0 rule:

• 3 copies of your data.
• 2 different media types.
• 1 offsite copy.
• 1 immutable, air-gapped copy.
• 0 errors during testing and recovery verification.

Many organizations claim to have good backups but have never actually tested full-scale restoration. Testing a few files annually isn't sufficient. Organizations need to understand:

• How long does it take to restore critical systems like domain controllers?
• What are the network bottlenecks during large-scale recovery?
• What's the correct order of operations for restoring interdependent systems?
• Do backups actually work when you need them?

Defensive Quick Win: Canary Tokens

Jamie introduced CanaryTokens.org, a free deception tool that creates digital tripwires throughout your environment.

These tools require minimal setup with no account needed, and provide detection capabilities that threat actors can't easily anticipate or circumvent.

Looking Forward

We'll be back on the first Tuesday of August at 1:00 PM Eastern. Mark your calendars and join us on YouTube or LinkedIn for more ransomware insights.

Mark your calendars for the upcoming SANS DFIR Summit in October, which now combines the Ransomware Summit, Threat Hunting Summit, and traditional DFIR content into one comprehensive event.

And remember to check out our upcoming SANS training events, including FOR528: Ransomware and Cyber Extortion, with a new course update, where we dive into the technical details of preventing, detecting, and responding to these types of attacks.