EFS ransomware attacks targeting Windows users could potentially overcome several major signature-based antivirus tools, researchers have discovered.

Developed by Microsoft and intended to offer full disk encryption, EFS — otherwise known as Windows Encrypting File System — was put to the test as part of an investigation by SafeBreach Labs. The firm created its own ransomware variant to see if antivirus tools would stop an attack. These included products from ESET, Kaspersky and one created by Microsoft itself.

According to the published results, all three of the tools tested failed to keep the EFS ransomware attacks at bay.

PoC Ransomware in Action

The tests involved using the proof-of-concept ransomware code to generate a key, which was used as an ESF key, and a certificate that would be added to the personal certificate store. Once the key had been invoked on folders and files marked for deletion, researchers saved it to memory and removed it from several areas of the system. These included %APPDATA% \Microsoft\Crypto\RSA\[userSID]\ as well as %ProgramData%\Microsoft\Crypto\RSA\MachineKeys\.

To make sure encrypted files were rendered unreadable, researchers then flushed EFS data from memory. At this point, a hard-wired public key in the ransomware encrypted the key file data and attempted to wipe slack parts of the disk. Attackers would then be able to tell victims their data is essentially being held hostage.

The technique described in the investigation isn’t foolproof. Getting control of a system again would be easy if the Data Recovery Agent is enabled, researchers said, and padlock icons that appear when the encryption is in process might tip potential victims off.

Since being informed of the risk, however, several antivirus vendors have announced plans to create workarounds or fixes, and some said they have already done so.

Have a Ransomware Recovery Strategy

Even if cybercriminals haven’t actually carried out EFS ransomware attacks yet, it’s a good reminder that organizations should be proactive in having a ransomware recovery strategy in place.

This includes ensuring backup storage for all critical files, double-checking that anti-virus tools have addressed threats like the one described above and, of course, training employees to avoid the risks.

More from

Securing Your SAP Environments: Going Beyond Access Control

Many large businesses run SAP to manage their business operations and their customer relations. Security has become an increasingly critical priority due to the ongoing digitalization of society and the new opportunities that attackers exploit to achieve a system breach. Recent attacks related to corrupt data, stealing personal information and escalating privileges for remote code execution all highlight the new and varied entry points threat actors have taken advantage of. Attackers with the appropriate skills could be able to exploit…

Who Carries the Weight of a Cyberattack?

Almost immediately after a company discovers a data breach, the finger-pointing begins. Who is to blame? Most often, it is the chief information security officer (CISO) or chief security officer (CSO) because protecting the network infrastructure is their job. Heck, it is even in their job title: they are the security officer. Security is their responsibility. But is that fair – or even right? After all, the most common sources of data breaches and other cyber incidents are situations caused…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…