Security solution

Which step of the ransomware kill chain encrypts files?

Its STEP 5...

Step 1 - Campaign distribution

Step 2 - Infection

Step 3 - Staging

Step 4 - Scanning

Step 5 - Encryption

Step 6 - Payday

Stage 7 or Actions on Objectives wherein the hackers are finally taking action to fullfil their purpose, such as encryption of files for ransom, data exfiltration or even data destruction.

Between stage 2 to 3

The basic kill chain phases of a ransomware attack are: distribution, infection, staging, scanning, encryption, and the big payday

It is between stage 5 to 7.

If devide Ransomware Kill chain in 3 stages than on 2nd phase encription occured. Many Cyber experts devided in 7 steps than on stage 4 encryption processed.

Sangfor Solution
Sangfor suggested a combination of Sangfor NGAF, HCI, and Endpoint Secure to harden network security and correlate their incident response capabilities.

Ensure those network security devices are properly deployed and installed to protect against both internal and external threats.

NGAF protects the network perimeter from external threats and attacks
NGAF and SSL-VPN restrict unauthorized users from accessing the internal network
Endpoint Secure protects endpoints from both known and unknown malware and viruses
NGAF URL and application filtering ensures that only authorized URL and applications can be assessed by authorized employees

Case Study of sangfor "success-stories/ransomware-attack-and-recovery-sangfor-indonesia"