Security News > 2022 > March > Lockbit wins ransomware speed test, encrypts 25,000 files per minute

The vendor's research team Surge today published research on how long it takes 10 of the big ransomware families including Lockbit, Conti, and REvil to encrypt 100,000 files.

While the criminal gangs' speeds varied, Surge found the median ransomware variant can encrypt nearly 100,000 files totaling 53.93GB in 42 minutes and 52 seconds.

"But if you have $100, and you can start moving your detections left and finding things before they encrypt, whether that be ransomware in flight or focusing on the tools that the ransomware operators use to get in the network and move laterally, there's a lot of value there."

To determine how quickly ransomware encrypts, the researchers selected 10 ransomware families with 10 separate binaries from each family.

"And that's kind of how LockBit ransomware works."

"We hope to evaluate the patterns that ransomware exhibits when encrypting files, ransomware worming behavior, how to cluster similar ransomware binaries based on fuzzy hashing algorithms, and future analysis of ransomware family attribution over time." .

News URL

https://go.theregister.com/feed/www.theregister.com/2022/03/23/ransomware_encryption_speed/