EFS ransomware attacks targeting Windows users could potentially overcome several major signature-based antivirus tools, researchers have discovered.

Developed by Microsoft and intended to offer full disk encryption, EFS — otherwise known as Windows Encrypting File System — was put to the test as part of an investigation by SafeBreach Labs. The firm created its own ransomware variant to see if antivirus tools would stop an attack. These included products from ESET, Kaspersky and one created by Microsoft itself.

According to the published results, all three of the tools tested failed to keep the EFS ransomware attacks at bay.

PoC Ransomware in Action

The tests involved using the proof-of-concept ransomware code to generate a key, which was used as an ESF key, and a certificate that would be added to the personal certificate store. Once the key had been invoked on folders and files marked for deletion, researchers saved it to memory and removed it from several areas of the system. These included %APPDATA% \Microsoft\Crypto\RSA\[userSID]\ as well as %ProgramData%\Microsoft\Crypto\RSA\MachineKeys\.

To make sure encrypted files were rendered unreadable, researchers then flushed EFS data from memory. At this point, a hard-wired public key in the ransomware encrypted the key file data and attempted to wipe slack parts of the disk. Attackers would then be able to tell victims their data is essentially being held hostage.

The technique described in the investigation isn’t foolproof. Getting control of a system again would be easy if the Data Recovery Agent is enabled, researchers said, and padlock icons that appear when the encryption is in process might tip potential victims off.

Since being informed of the risk, however, several antivirus vendors have announced plans to create workarounds or fixes, and some said they have already done so.

Have a Ransomware Recovery Strategy

Even if cybercriminals haven’t actually carried out EFS ransomware attacks yet, it’s a good reminder that organizations should be proactive in having a ransomware recovery strategy in place.

This includes ensuring backup storage for all critical files, double-checking that anti-virus tools have addressed threats like the one described above and, of course, training employees to avoid the risks.