Summarize this blog article with AI:
Ask ChatGPT
Ask Grok
Ask Perplexity
Ask Claude
Ask Google AIRansomware attack techniques are continuously evolving. Sangfor's security team tracks these changes through threat intelligence, incident response at customer sites, and product operational data. Rather than focusing solely on emerging ransomware families, we examine the techniques that repeatedly undermine existing defenses and translate these findings into targeted updates for Sangfor Athena EPP.
The stakes are significant. According to IDC's State of Ransomware in Asia/Pacific (September 2026), which draws on its 2025 Future Enterprise Resiliency and Spending Survey, 80% of surveyed organizations in Asia-Pacific experienced ransomware attacks that blocked access to systems or data, while 51% reported paying a ransom.
Sangfor's recent observations highlight two recurring attack tactics that expose important gaps in conventional endpoint protection.
1. Disabling Endpoint Protection Before Encryption
Before launching encryption, some ransomware operators attempt to disable the security agent running on the targeted endpoint. When an agent stops functioning, its detection, backup, and recovery operations no longer execute. As a result, existing security defenses may become ineffective before ransomware encryption even begins.
Furthermore, the management console may not provide any indication that endpoint protection has been compromised.
Attackers commonly employ four techniques:
- EDR killers: Purpose-built tools that terminate security processes, including endpoint detection and response (EDR) agents.
- Bring Your Own Vulnerable Driver (BYOVD): Exploiting legitimately signed but vulnerable drivers to gain kernel-level privileges and terminate security agent processes.
- Windows rule abuse: Misusing Windows Filtering Platform (WFP), Quality of Service (QoS), and Windows Defender Application Control (WDAC) rules to interfere with an agent's security rules or communications.
- LSASS-based code injection: Using the Local Security Authority Subsystem Service (LSASS) to inject malicious code into security agent processes.
These activities fall under MITRE ATT&CK technique T1685 (Disable or Modify Tools).
In its joint advisory on Akira ransomware (AA24-109A), the U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified the removal of EDR systems and the use of BYOVD techniques to disable antivirus software among the group's defense-evasion methods.
How Athena EPP Responds: Agent Self-Protection
To counter these techniques, Athena EPP strengthens its agent self-protection capabilities through four measures:
- Process protection: Prevents the agent process from being terminated through methods outside the product.
- Injection prevention: Closes the LSASS-to-agent injection path by removing the
PROCESS_CREATE_THREADpermission. - Windows rule protection: Identifies and blocks the misuse of WFP, QoS, and WDAC rules.
- BYOVD protection: Detects and blocks newly emerging vulnerable drivers used in BYOVD attacks.
Together, these measures ensure that endpoint protection remains operational throughout an attack, preventing agent termination from rendering the overall protection ineffective.
2. Remotely Encrypting Shared Files Over SMB
The second tactic exploits a different detection blind spot: the ransomware executes on one machine while the targeted files reside on another.
In this scenario, ransomware runs on a compromised or unmanaged endpoint. Using the Server Message Block (SMB) protocol, it accesses files in a shared directory, encrypts them, and writes the encrypted files back to their original location.
On the file server hosting the shared directory, Windows system components process what appear to be normal SMB file-write requests. Because the ransomware executes on a separate endpoint, there is no local malicious process for conventional process-based detection to analyze. As a result, security tools that primarily monitor local process behavior may fail to recognize the attack.
MITRE ATT&CK documents the use of SMB network shares for remote access and lateral movement under technique T1021.002 (Remote Services: SMB/Windows Admin Shares).
CISA's #StopRansomware Guide also recommends restricting SMB access between workstations and isolating TCP port 445 between machines or workstation subnets to reduce the risk of these attacks.
How Athena EPP Responds: SMB-based Remote Ransomware Protection
Athena EPP addresses this threat through three layers of protection that operate on the shared directories themselves, rather than relying solely on monitoring the endpoint initiating the file access.
Layer 1: Real-Time File Activity Monitoring
Athena EPP continuously monitors file-opening, writing, renaming, and overwriting patterns within protected shared directories. Hidden ransomware bait files act as tripwires, triggering alerts when they are accessed.
Layer 2: Behavioral Detection
The solution identifies suspicious activity patterns associated with remote ransomware encryption, including:
- Read–encrypt–write-back file operation sequences.
- Ransom note placement.
- Remote sessions exhibiting characteristics consistent with encryption activity.
Layer 3: Immediate Network-Level Response
When suspicious encryption activity is detected, Athena EPP uses Windows Filtering Platform (WFP) to terminate the associated SMB session and block the source connection.
With SMB-based Remote Ransomware Protection, Athena EPP can identify the source IP address of suspicious SMB activity, providing visibility beyond the local Windows System process on the file server.
It can also interrupt encryption while it is in progress, preventing the attack from spreading across the entire shared directory.
3. Existing Anti-Ransomware Capabilities
These targeted updates complement Athena EPP's existing anti-ransomware capabilities, which remain unchanged.
- Ransomware Bait Files: Detect ransomware activity without relying on signatures, providing coverage against unknown ransomware families and variants.
- Static AI and Dynamic AI Detection: Uses static and dynamic AI to analyze threats before and during execution, respectively.
- Rapid Blocking and Recovery: Blocks ransomware within 3 seconds and begins recovery in the fourth second.
- File Backup and VSS Snapshot Backup: Provide the data foundation needed to support recovery.
- One-Click Kill: Enables administrators to deploy response actions across network endpoints from a centralized management console.
4. How Customers Can Access These Capabilities
The two targeted protection updates described above are delivered differently depending on whether customers use SaaS or on-premises deployments.
For SaaS Deployments
The new capabilities will be delivered through ongoing version updates. No additional action is required from customers, and the capabilities can be used once they become available.
For On-Premises Deployments
The new capabilities will be delivered through Service Pack (SP) releases, which require customers to upgrade their existing deployments.
We recommend regularly reviewing the latest SP release notes in the Sangfor Community and upgrading promptly to ensure that the relevant protection capabilities remain up to date.
View Athena EPP SP Update Announcements
Customers can also follow Sangfor's recommended anti-ransomware policy configuration practices to make effective use of the available protections.
View Anti-Ransomware Policy Configuration Best Practices
5. Staying Ahead of Evolving Ransomware Tactics
As ransomware operators continue to adapt their techniques, effective protection must address more than the ransomware executable itself.
By strengthening agent self-protection and adding layered detection and response capabilities for SMB-based remote encryption, Sangfor Athena EPP addresses both attack scenarios while building on its existing anti-ransomware defenses.
Learn more about Athena EPP's ransomware protection capabilities:
- Remote Encryption Over SMB: The Ransomware Attack Hidden in Legitimate File Traffic
- Watch the Demo: SMB-based Remote Ransomware Protection in Action
- Explore Sangfor Anti-Ransomware Solutions
- Explore Sangfor Athena EPP
References
- MITRE ATT&CK: Disable or Modify Tools (T1685)
- MITRE ATT&CK: Remote Services: SMB/Windows Admin Shares (T1021.002)
- CISA: #StopRansomware Guide
- CISA: Akira Ransomware Joint Advisory AA24-109A, updated November 2025.
- IDC: State of Ransomware in Asia/Pacific: Attack Trends, Business Impact, and Essential Guidance for Security Leaders, September 2026, Document No. AP54913126.
