Why Your Antivirus Can't Stop New Ransomware

Published on August 12, 2026 · 8 min read

Last year, a small company I was helping had their shared drive encrypted. The entry point? A PDF from a supplier. Nothing unusual about it, until Word files started changing extensions.

The window between "new variant" and "known variant" is usually hours. Sometimes days. During that time, your machine is effectively unprotected.

AV vendors don't see a new file until someone submits it — usually the first victim. Analyzing it, writing a signature, pushing it out to every endpoint — that takes hours. By then someone else is already hit.

How Ransomware Actually Works

Step 1: How It Gets In

So how does this thing get on your machine? Couple of ways:

• Phishing email attachments — the classic
• Browser exploits — you visit a site, you get hit
• Fake CAPTCHA pages tricking you into pasting PowerShell commands
• Compromised downloads — even legit sites get poisoned

Step 2: Staying Alive

The malware needs to survive a reboot. So it plants itself:

Registry Run keys:
            HKLM\Software\Microsoft\Windows\CurrentVersion\Run
            HKCU\Software\Microsoft\Windows\CurrentVersion\Run

            Scheduled tasks:
            schtasks /create /tn "WindowsUpdate" /tr "C:\temp\malware.exe" /sc daily

            Startup folder:
            %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\

Step 3: Reconnaissance

Now the malware starts poking around:

systeminfo
            whoami
            ipconfig /all
            net view
            net use
            dir C:\Users\ /s /b

It's mapping your drives. Looking for shared folders. Finding backups. Figuring out what's worth encrypting.

Step 4: Killing Your Security

Before encryption starts, the malware tries to kill your antivirus. Here's what that looks like:

Disable Defender real-time monitoring:
            powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

            Stop and disable Defender:
            sc stop WinDefend
            sc config WinDefend start= disabled

            Delete shadow copies so you can't recover:
            vssadmin delete shadows /all /quiet

            Disable Windows Recovery:
            bcdedit /set {default} recoveryenabled no
            bcdedit /set {default} bootstatuspolicy ignoreallfailures

I've seen variants that go after the Security Center too.

At this point, your system has no protection left.

Step 5: Encryption

Modern ransomware usually uses AES-256 for speed, plus RSA for key protection.

For each file, it does this:

1. Read the file into memory
            2. Generate an AES key for this file
            3. Encrypt the file with AES-256-CBC
            4. Encrypt the AES key with the attacker's RSA public key
            5. Append the encrypted key to the file
            6. Delete the original file
            7. Rename it with a new extension (.encrypted, .locked, .crypted)

Your files are gone. The AES key is RSA-encrypted with the attacker's public key. Without their private key, no one — including you — can decrypt anything.

Step 6: Cleanup

Then it cleans up after itself:

wevtutil cl System
wevtutil cl Security
wevtutil cl Application
wevtutil cl Windows PowerShell

del /f /q C:\temp\malware.exe

By the time it's done, the malware is gone, the logs are wiped, and all that's left is encrypted files and a ransom note.

What Traditional Antivirus Is Actually Doing

Most AV products today still lean on signatures. They've added behavioral checks and cloud lookups over the years, but the foundation is a database of known-bad files. If a file doesn't match anything in that database, a lot of products will just let it run.

They might catch it later, once the behavior crosses some threshold. But by then, encryption is usually already underway.

Your AV might watch a program rename 10,000 files in 5 seconds and not react — because it doesn't have a rule that says "renaming thousands of files quickly is malicious." Or it might react, just a few seconds too late.

And many of these checks depend on a cloud lookup. If your network is down, that lookup fails. The malware runs anyway.

WinRansomProtect Works Differently

It doesn't rely on hash lookups. What it cares about is what a program does.

WinRansomProtect watches what programs do. Not what they're named. Not what their hash says. What they actually do.

It looks for stuff that doesn't belong:

Abnormal file operations

• Hundreds of file modifications per second — no human works that fast
• Opening a large number of files in a short time window
• Bulk renaming files to .encrypted, .locked — dead giveaway

Suspicious process behavior

• Weird command-line arguments (long PowerShell scripts, Base64-encoded commands)
• Creating scheduled tasks or Run keys
• Calling vssadmin (deleting shadow copies)
• Trying to disable Defender — pretty suspicious, right?

Unusual read/write patterns

• Read file → write encrypted data → delete original
• Heavy disk I/O with no user activity
• Writing ransom notes to disk — that's a pretty clear sign

Example:

A program opens 500 files in 5 seconds. Reads each one. Writes encrypted data back. Renames everything to .encrypted. Deletes the originals.

Traditional AV would just log the file operations. WinRansomProtect notices what's happening and stops it.

Why This Stops 0-Day Ransomware

WinRansomProtect doesn't need to know what file you opened. It just needs to see what that file is doing.

If it's doing ransomware things, it gets blocked. Doesn't matter if this variant came out five minutes ago or last year. The behavior is the same.

If your network goes down, the detection engine doesn't care — it's already running locally.

What You Can Do Right Now

One.

Check your antivirus. If it relies on daily signature updates, you're exposed during 0-day windows. That's just how signature-based AV works.

Two.

Check your backups. Ransomware goes after backups first. If your backup is always connected, it gets encrypted too. Use offline backups.

Three.

Know what's on your machine. Check your startup items, scheduled tasks, and Registry Run keys. Look for anything unfamiliar.

Four.

Add an offline behavioral protection layer. WinRansomProtect doesn't replace your existing antivirus. It adds a layer that doesn't rely on the cloud. Think of it as a backup plan — one that actually works when the network goes down.