Security solution

Which step of the ransomware kill chain encrypts files?

Sangfor Solution
Sangfor suggested a combination of Sangfor NGAF, HCI, and Endpoint Secure to harden network security and correlate their incident response capabilities.

Ensure those network security devices are properly deployed and installed to protect against both internal and external threats.

NGAF protects the network perimeter from external threats and attacks
NGAF and SSL-VPN restrict unauthorized users from accessing the internal network
Endpoint Secure protects endpoints from both known and unknown malware and viruses
NGAF URL and application filtering ensures that only authorized URL and applications can be assessed by authorized employees

Case Study of sangfor "success-stories/ransomware-attack-and-recovery-sangfor-indonesia"

If devide Ransomware Kill chain in 3 stages than on 2nd phase encription occured. Many Cyber experts devided in 7 steps than on stage 4 encryption processed.

It is between stage 5 to 7.

The basic kill chain phases of a ransomware attack are: distribution, infection, staging, scanning, encryption, and the big payday

Between stage 2 to 3

Stage 7 or Actions on Objectives wherein the hackers are finally taking action to fullfil their purpose, such as encryption of files for ransom, data exfiltration or even data destruction.

Its STEP 5...

Step 1 - Campaign distribution

Step 2 - Infection

Step 3 - Staging

Step 4 - Scanning

Step 5 - Encryption

Step 6 - Payday

There are 7 Stages of a Ransomware Kill Chain. The encryption of files begins in STAGE 5 - Encryption[/color] , this is where the dreaded process begins.It’s here where your data becomes transformed into its inaccessible form. There are two approaches to the encryption phase. One is to encrypt everything as quickly as possible. The other is a slow burn in which files are encrypted in slow order over time to escape detection.