Loading story…
Elastic Security 8.11 added a ransomware-response capability that triggers a full memory dump when sticky canary files detect attempted encryption. Elastic Defend stores compressed dumps locally in the protected Endpoint cache rather than sending them to Elastic, enabling responders to preserve volatile evidence from the encrypting process. Elastic demonstrated recovery of an in-memory AES-128 session key from a captured NotPetya process dump and showed that, under constrained CPU-affinity conditions, a dumped WannaCry process's Windows PRNG state can help predict future per-file AES keys.
The capability is intended as a forensic and recovery aid rather than a universal ransomware control, since key handling and encryption behavior differ across families. Separately, Malpedia published an autogenerated YARA rule for the Windows LockBit family; it targets files below 2,049,024 bytes and requires at least seven matches from 18 sample-derived byte sequences, providing an additional static-detection option for LockBit artifacts.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Felix Bilstein's yara-signator autogenerated the "win_lockbit_auto" YARA rule to detect the LockBit Windows malware family. The rule targets files below 2,049,024 bytes and requires at least seven of 18 byte-pattern sequences to match.
Elastic reconstructed WANNACRY process memory and thread context and emulated the Windows random-number-generation workflow, correctly predicting output on a single-core system. It found that constraining the detected process to a selected CPU affinity could enable reliable prediction of future per-file AES keys on multi-core systems.
In contained testing, Elastic identified NOTPETYA's active encryption thread in a captured dump and extracted its in-memory AES-128 session key from the CryptoAPI context. Elastic concluded that the key could enable decryption of files encrypted by that ransomware process.
Elastic Defend/Elastic Security 8.11 added generation of complete local process-memory dumps when ransomware protection detects attempted encryption of a canary file. The compressed dumps are stored in the protected Endpoint cache directory and are not submitted to Elastic.
Elastic Endpoint began using canary files in version 7.14 to identify processes attempting to overwrite decoy files and trigger ransomware protection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic added behavioral Windows keylogger detection to **Elastic Defend 8.12**, using Event Tracing for Windows (ETW) to observe API activity associated with keystroke collection through polling, keyboard hooks, Raw Input, and DirectInput. Prebuilt endpoint rules identify suspicious use of APIs including `GetAsyncKeyState`, `SetWindowsHookEx`, and `RegisterRawInputDevices`. In testing on Windows 10, Elastic Defend detected a proof-of-concept Raw Input keylogger soon after it executed, flagging an untrusted process that registered for keyboard input. The telemetry captures API arguments, call-stack context, process-signature status, and related process metadata, enabling defenders to investigate credential- and information-theft activity while reducing false positives from legitimate accessibility and input software.
Aug 27, 2026
Elastic Security Labs documented how to unpack ICEDID’s fake-GZip variant, a credential- and banking-information-stealing malware family that uses custom file formats and encryption to impede analysis. The examined sample contained an encrypted configuration, core binary, and persistence loader; recovered configuration data identified `alishaskainz[.]com` and `villageskaier[.]com` as C2 domains and `/news/` as the beacon URI. The workflow reconstructs ICEDID custom PE files, including x64 and x86 browser-hook payloads, for static analysis; execution should be limited to isolated environments. Separately, Malpedia published an autogenerated YARA signature for Windows **DarkVNC**. The rule evaluates ten byte-pattern sequences and matches files below 606,208 bytes when at least seven patterns are present, providing a detection option for the remote-access malware family. The reference does not attribute DarkVNC to a specific incident, campaign, or threat actor.
Aug 26, 2026
REvil/Sodinokibi continued to evolve its ransomware toolkit with updated encryption and execution features aimed at improving impact on victim environments. Analysis of version `2.2` showed the malware restored persistence through the Windows `Run` registry key when configured to do so and added use of the Windows Restart Manager to identify processes and services locking targeted files, then terminate those processes or stop and delete services so encryption can proceed. Researchers also noted the malware can remove a critical-process protection flag before killing a process, potentially destabilizing infected systems, while retaining familiar behaviors such as shadow copy deletion, process termination, ransom note deployment, wallpaper changes, and encrypted configuration parsing. Separate reporting tied REvil to a broader set of delivery and targeting methods across Windows, Linux, and enterprise infrastructure. A PowerShell-based loader was observed disabling AMSI, decrypting an embedded payload, and using in-memory shellcode injection to launch REvil without writing the final executable directly to disk. Earlier technical analysis described phishing-delivered JavaScript loaders, PowerShell staging, UAC bypass, optional exploitation of `CVE-2018-8453`, and process hollowing, while additional reporting and indicators linked the group to Linux ransomware samples and exploitation of Oracle WebLogic Server vulnerabilities for initial access. Together, the references show an operation refining both its post-compromise encryption logic and its initial access and execution tradecraft.
Aug 15, 2026