Researchers have discovered a type of ransomware encryption technique being increasingly utilised by hackers.

Aleksandar Milenkoski and Jim Walter, researchers at SentinelLabs, said that the ‘intermittent encryption’ technique is now being heavily advertised to hackers.

The method, the researchers said, allows ransomware operators to evade detection systems more easily, and boost the speed that victims’ files can be encrypted.

By only partially encrypting victims’ files, threat actors can cause “irretrievable damage in a very short time frame,” the pair said in a blog post.

Additionally, such encryption helps to confuse the statistical analysis used by security tools to detect ransomware activity.

“Such an analysis may evaluate the intensity of file IO operations or the similarity between a known version of a file, which has not been affected by ransomware, and a suspected modified, encrypted version of the file,” they said.

“In contrast to full encryption, intermittent encryption helps to evade such analyses by exhibiting a significantly lower intensity of file IO operations and much higher similarity between non-encrypted and encrypted versions of a given file,” the pair added.

The blog post revealed that LockFile was the first variant to use the new technique, encrypting every other 16 bytes of a file.

Recommended

• European open banking could be slowed by fraud risk
• Leader Insights | What Scotland can learn from Silicon Valley
• AI could help solve ‘cocktail party effect’ for hearing aid users

Since then, SentinelOne has identified several ransomware families following suit and adopting intermittent encryption, including Qyick, Agenda, BlackCat (ALPHV), Play, and Black Basta.

The security industry may have to adapt to the new trend in order to improve its detection capabilities.

“Intermittent encryption is a very useful tool to ransomware operators. This encryption method helps to evade some ransomware detection mechanisms and encrypt victims’ files faster,” the researchers said in the blog post.

“Given the significant benefits to threat actors while also being practical to implement, we estimate that intermittent encryption will continue to be adopted by more ransomware families.”

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.