Ransomware Has Learned to Fight Back

Why attackers now target security controls before encrypting data

For years, ransomware was viewed as a simple equation: attackers gain access, encrypt files, and demand payment. Organizations invested heavily in backups and endpoint protection with the assumption that preventing encryption was the primary objective.

That assumption no longer reflects how modern ransomware operates.

Today’s ransomware groups increasingly focus on weakening defenses before deploying their final payload. They disable security tools, remove recovery options, steal credentials, and create the conditions needed for a successful attack. The goal is no longer just to encrypt data, it is to make detection and recovery significantly harder.

Recent ransomware campaigns demonstrate a shift in attacker strategy: security controls themselves have become targets. This article explores how threat actors are attempting to blind organizations before an attack unfolds and how detection engineering can identify these behaviors earlier.

Attackers Do Not Just Break In. They Disable Defenses.

Modern ransomware operators understand that endpoint security products are one of the biggest obstacles between initial compromise and a successful encryption event.

Instead of immediately deploying ransomware, attackers often spend time preparing the environment. This preparation may include disabling antivirus capabilities, terminating security processes, modifying security configurations, and deploying tools designed to evade detection.

One example of this trend is the use of techniques such as modifying Microsoft Defender settings to reduce visibility. Commands that disable real-time monitoring or behavior monitoring can create a window where malicious activity occurs without triggering protection mechanisms.

These actions are particularly dangerous because they often use legitimate administrative functionality. Attackers are not always exploiting a vulnerability, they are abusing tools already trusted by the operating system.

The first stage of a ransomware attack is no longer encryption. It is removing the organization’s ability to see the attack coming.

For security teams, this changes the detection priority. Monitoring only the final ransomware payload is too late. The focus must move toward identifying the behaviors that happen before encryption.

Security Tools Have Become Part of the Battlefield

The growth of ransomware has pushed attackers toward more advanced defense evasion techniques. Recent campaigns have demonstrated the use of techniques such as security software termination, vulnerable driver abuse, and attempts to interfere with endpoint monitoring capabilities.

This evolution creates a challenge for traditional security approaches. A malicious file may never be the first indicator. The earliest warning signs are often changes to the security environment itself.

Examples of suspicious activity include:

• Attempts to disable Microsoft Defender protections

• Adding antivirus exclusions for unusual directories

• Stopping security-related services

• Loading suspicious kernel drivers

• Modifying recovery settings

• Deleting shadow copies

• Removing backup and forensic artifacts

These behaviors are valuable because they occur before the destructive phase of the attack.

Attackers do not need to bypass every security control if they can convince the system to lower its own defenses.

This is why behavior-based detection has become essential. A security team should not only ask, "Was malware executed?" but also, "Did something attempt to make malware execution easier?"

Ransomware Follows a Detectable Attack Path

Despite changes in ransomware names, tools, and infrastructure, many attacks follow a similar sequence of behaviors.

The malware family may change, but the preparation steps often remain consistent.

A typical ransomware attack path looks like this:

Initial Access

    ↓

Privilege Escalation

    ↓

Security Tool Disablement

     ↓

Credential Theft

    ↓

Recovery Prevention

    ↓

Lateral Movement

    ↓

Data Encryption

The earlier organizations detect activity in this chain, the more opportunities they have to contain the attack before business disruption occurs.

Ransomware does not begin when files are encrypted. It begins when attackers prepare the environment for encryption.

This is where behavior-based detection becomes essential. Cybersift focuses on detecting attacker techniques throughout the attack lifecycle, helping security teams identify ransomware preparation activity before it becomes a major incident.

Related Detection Rules

The techniques discussed in this article can be identified through behavior-based detections, including:

• Microsoft Defender Protection Disabled

  Detects attempts to disable Microsoft Defender real-time protection and behavior monitoring capabilities, helping identify attempts to reduce endpoint visibility before malicious execution.(Link: Microsoft Defender Protection Disabled)

• Volume Shadow Copy and Backup Deletion

  Identifies attempts to remove Volume Shadow Copies and backup catalogs, a common ransomware technique used to prevent recovery.(Link: Volume Shadow Copy and Backup Deletion)

• Boot Recovery Configuration Modified

  Detects changes to Windows boot recovery settings that may prevent automated recovery mechanisms from functioning after an attack.(Link: Boot Recovery Configuration Modified)

These detections focus on attacker behavior rather than individual ransomware families, allowing organizations to identify common techniques even as threat groups change their tools and infrastructure.

Ransomware Defense Starts Before Encryption

The biggest lesson from modern ransomware campaigns is that prevention cannot rely on stopping the final payload alone.

By the time files are encrypted, attackers may have already disabled defenses, compromised accounts, removed recovery options, and moved throughout the environment.

Security teams need visibility into the preparation phase - the moment when attackers begin changing the environment to their advantage.

The strongest ransomware defenses detect attacker intent before they detect attacker impact.

This requires continuous monitoring, behavioral detections, and security operations processes designed around attacker techniques rather than individual malware families.

Cybersift helps organizations identify suspicious activity earlier through detection engineering and continuous security monitoring, including detections for defense evasion techniques.

-Written by Stanislav Stoychev