Hacks

RIPlace a new evasion technique that allows threat actors to encrypt files on Windows-based computers without being detected by anti-ransomware products. Nyotron’s Security researchers discovered a new technique that leverages Microsoft Windows file system rename operations to stay undetected from security products, RIPlace Evasion Technique Attackers can use this RIPlace method to alter any files on the computers running with Windows XP or the new version of operating systems. According to Nyotron’s  Research , all antivirus products including Endpoint Detection and Response tested so far were completely blind to file operations using this technique, including encryption. Whenever a renamed file requests operation being called the  IRP_MJ_SET_INFORMATION  it requests to set metadata about a file with  FileInformationClass  set to  FileRenameInformation  and then filter gets a callback, so that it could filter the request. Researchers call  DefineDosDevice  that can p