<\/p>\n\n\n\n
Sophos<\/a><\/strong>, a globally recognized leader in the field of cybersecurity as a service, has unveiled a new report titled “CryptoGuard: An Asymmetric Approach to the Ransomware Battle<\/a><\/strong>” The report highlights a deliberate trend among prominent ransomware groups such as Akira<\/a>, ALPHV\/BlackCat<\/a>, LockBit<\/a>, Royal<\/a>, and Black Basta, wherein they employ remote encryption during their attacks. Remote encryption, also known as remote ransomware, involves exploiting a compromised and often inadequately protected endpoint to encrypt data on other devices connected to the same network.<\/p>\n\n\n\n Sophos CryptoGuard<\/a>, an anti-ransomware technology acquired by Sophos in 2015 and integrated into all Sophos Endpoint<\/a> licenses, serves as a crucial element in the company’s layered endpoint protection. This technology monitors and safeguards against the malicious encryption of files, offering immediate protection and rollback capabilities, even in cases where the ransomware itself doesn’t manifest on a protected host. The report reveals a significant 62% year-over-year increase in intentional remote encryption attacks since 2022.<\/p>\n\n\n\n Mark Loman, Vice President of Threat Research at Sophos and co-creator of CryptoGuard<\/strong>, emphasized the vulnerability posed by remote ransomware, stating that a single underprotected device within a network can compromise the entire system. Given the observed increase in remote encryption attacks, he anticipates this method to persist as a perennial challenge for defenders.<\/p>\n\n\n\n Traditional anti-ransomware protection methods deployed on remote devices often fail to detect malicious files or their activities, leaving them susceptible to unauthorized encryption and potential data loss. However, Sophos CryptoGuard employs an innovative approach by analyzing file contents to detect signs of encryption, irrespective of the presence of malware on the device. This method stands in contrast to conventional solutions that focus on detecting malicious binaries or execution.<\/p>\n\n\n\n