How ransomware encrypts files, per ATT&CK T1486

Picus published an article some time ago with a summary overview of T1486. It explains why ransomware usually pairs a fast symmetric cipher such as AES or ChaCha20 for the files with RSA or ECDH to lock away the key, and how Nefilim abuses Microsoft’s Enhanced Cryptographic Provider to do it. Picus Labs’ Red Report 2023 claims that a quarter of the more than half a million malware samples it analysed can perform ransomware attacks. SentinelLabs described how families such as BlackCat, PLAY and Black Basta encrypt only parts of each file, which is faster and leaves less of a statistical trail for detection to catch. Doing less work for the same damage: efficiency, criminal edition.