Ransomware Operators Blind Defenses Before Encryption
Ransomware attackers are increasingly disabling endpoint detection and response (EDR) tools, Windows telemetry, and backup services before encrypting data, aiming to reduce detection and recovery options for defenders.
Ransomware operators are adopting a sophisticated pre-encryption strategy, focusing on disabling critical defensive and recovery mechanisms before initiating data encryption. This tactic aims to create a window of opportunity where their actions go unnoticed and recovery becomes significantly more challenging for victim organizations.
Analysis of several ransomware families, including LockBit 5.0 and BabLock, reveals a common pattern of defense impairment. Attackers gain initial access and then systematically target security software, logging services, and backup solutions. This preparatory phase is crucial for ensuring the ransomware can execute its payload with minimal resistance and that evidence of the intrusion is obscured.
Picus Security researchers observed that this defense-impairment activity is not an initial access technique but rather a crucial step in the post-compromise kill chain. By neutralizing EDR tools, clearing event logs, and interfering with Windows telemetry, threat actors significantly reduce the likelihood of early detection and the availability of forensic data for incident responders.
The consequences of these actions are severe. When visibility into endpoint activity, the integrity of event records, and the functionality of backup operations are all compromised, security teams are left without essential early warning signals and viable recovery pathways. This makes containing the breach and restoring systems a far more arduous and potentially impossible task.
Specific examples highlight the varied approaches. BabLock has been observed using legitimate vendor uninstallers to terminate antivirus, EDR, backup, and database processes, followed by clearing security and system event logs. LockBit 5.0, on the other hand, interferes with Windows Event Tracing (ETW), a telemetry mechanism vital for many monitoring products, effectively starving them of critical security signals.
Other ransomware families employ different methods to achieve similar outcomes. Some embed encrypted code that only decrypts at runtime, while others use techniques like process injection or masquerade as legitimate system processes to evade detection. Post-execution, some actors focus on removing traces and altering timestamps to complicate investigations.
To counter these tactics, organizations must move beyond simply installing security products. It is imperative to rigorously test whether existing controls can detect and block attempts to stop services, erase logs, alter telemetry, or inject code. This includes validating the resilience of backup systems, ensuring they are isolated from the production network and regularly tested for recoverability.
Defenders should also prioritize centralized, tamper-resistant logging solutions to preserve evidence when local logs are compromised. Implementing alerts for unusual service stoppages, security tool tampering, and changes to telemetry functions can provide crucial indicators of the attack's preparation phase. Coupled with least-privilege access and network segmentation, these measures can limit the impact of an intrusion and improve the chances of a successful defense and recovery.