Why detection and response technology won’t solve all ransomware attacks

Ransomware has become prolific, with a new ransomware attack striking on average every 10 seconds. That figure may shrink to just two seconds by 2031. Today’s threat actors are powerful and sophisticated enough to successfully hold national governments ransom. But this doesn’t mean that state-level entities are their primary targets.

On the contrary, ransomware groups are increasingly targeting both enterprises and SMBs thanks to an attractive effort-to-reward ratio. According to the 2023 Verizon Data Breach Investigations Report, ransomware was a top action-type present in breaches, at 24% of reported breach data.

The Verizon report suggests that for ransomware victims, the overall costs of recovering from an incident are increasing. Potential and extended system downtime, insurance complications, regulatory reporting processes and potential fines, and exposed customer, partner, or employee data introduce long-term and highly damaging ramifications. Preventing an attack in the first place has become imperative.

Endpoint detection and response (EDR) and extended detection and response (XDR) are industry-standard when it comes to ransomware protection and attack mitigation, using a combination of signature and behavior-based detection methods to protect against known and detectable threats. However, threat actors have adapted and developed tactics and techniques that can successfully evade EDR and XDR systems. The techniques are well-documented, including in-memory attacks, fileless malware, and other defense evasive techniques. Multiple studies show these comprise of more than 30% of malware seen in the wild.

Recent examples include new variants of the BlackBasta ransomware that evaded detection by EPP and EDR solutions, GuLoader, an advanced threat targeting legal and investment firms in the U.S., and InvalidPrinter, a highly-stealthy loader that had zero detection on Virus Total for an extended period. ProxyShellMiner, a variant targeting ProxyShell vulnerabilities in MS-Exchange, is another well-documented example.

Attackers have spent the last several years refining techniques that create the conditions for ransomware attacks at scale. Two advancements work in their favor:

Time to change the security paradigm

While attackers employ polymorphism to evade detection, defenders can also apply this technique. Consider that in the event of an attack, if a target resource doesn’t exist or it’s continually morphed (moved), the chance of targeting a system is significantly reduced. 

Automated moving target defense (AMTD) technologies use polymorphism to move, change, obfuscate, and/or morph attack surfaces and disrupt adversary kill chains. AMTD effectively guards against attacks by introducing complexity, uncertainty, and prevention tactics. Its origins are linked to military strategy for sniper defense and relies on cover and concealment and staying mobile to eliminate the opportunity for a clear shot.

For example, if a highly trained and extremely intelligent sniper targets a hidden or continuously moving target, the sniper’s chances of success are reduced. The sniper may even compromise or expose themselves due to repeated and incorrect misfires.

AMTD technologies work as an application loads to memory space; the technology morphs and conceals process structures, and other system resources, deploying lightweight skeleton traps to deceive attackers. Unable to access original resources, malicious code fails, thereby stopping and logging attacks with full forensic details.

This prevention-first approach can stop threats cold, even if existing AI-based detection and response tools are bypassed. Since the attacks are prevented, security teams gain crucial time to investigate threats while knowing their systems are safe.  The deterministic nature of AMTD also means that the solution generates high-fidelity alerts, which helps prioritize efforts by security teams, reducing alert fatigue.

AMTD technology doesn’t replace detection and response systems. Rather, it offers an additional layer of defense and complements EDR and XDR toolsets. AMTD boosts capabilities and hardens the overall attack surface using defense-in-depth capabilities that stop unknown attacks that existing detection and response solutions can’t.

The growing prevalence and sophistication of ransomware and other cyberattacks underscore the importance of strengthening and advancing endpoint protection. Defenders should take a page from adversary playbooks: adopt the tactics they use. Don’t only attempt to detect and retroactively remediate their attacks, but evolve to pre-emptively prevent them from occurring.

Ronen Yehoshua, co-founder and CEO, Morphisec