Full Report
Read about the exciting new updates to our Ransomware Canaries service.
Analysis Summary
# Tool/Technique: Ransomware Canaries (v2 Update)
## Overview
Ransomware Canaries is a proactive detection service designed to identify early-stage ransomware activity. It utilizes "honeyfiles" or "canary files"—small, hidden files placed on an endpoint that sit dormant and are continuously monitored for unauthorized changes. If these files are modified or encrypted, it serves as an early warning system for a potential ransomware outbreak, allowing for faster incident response.
## Technical Details
- **Type:** Technique / Defensive Tool (Deception Technology)
- **Platform:** Windows (User and System profiles)
- **Capabilities:** File integrity monitoring, early ransomware detection, branding for MSPs, and user education via QR codes.
- **First Seen:** Original version launched circa 2020; v2 Update published January 14, 2022.
## MITRE ATT&CK Mapping
- **[TA0040 - Impact]**
- **[T1486 - Data Encrypted for Impact]**: Canaries are specifically designed to detect this technique by triggering an alert when files are encrypted.
- **[TA0007 - Discovery]**
- **[T1083 - File and Directory Discovery]**: Ransomware often discovers these files during the enumeration phase before encryption.
## Functionality
### Core Capabilities
- **Deceptive Placement:** Places hidden files within user profiles where ransomware typically begins encryption.
- **Continuous Monitoring:** ThreatOps analysts monitor the files for changes, distinguishing between benign user behavior and malicious encryption.
- **Multi-Extension Support:** Utilizes multiple file types including `.docx`, `.xlsx`, and `.pdf` to ensure detection even if a ransomware variant targets specific extensions.
- **System Profile Visibility:** Places canaries at the system level to detect ransomware that operates outside of standard user directories.
### Advanced Features
- **EFS Distinction:** The v2 update improves the ability to differentiate between legitimate Windows Encrypting File System (EFS) activity and unauthorized ransomware encryption.
- **Custom Branding:** Allows MSPs to add their own logos and support links to the canary metadata, ensuring end-users who accidentally discover the files are directed to their specific IT provider rather than the tool vendor.
- **QR Code Education:** Embedded QR codes link to educational resources to prevent "accidental" tampering by curious employees.
## Indicators of Compromise
*Note: As a defensive tool, these are indicators of the tool's presence, not the malware itself.*
- **File Names:** Randomly generated or common-looking documents (e.g., Word, Excel, PDF) hidden in user and system directories.
- **Behavioral Indicators:** Unexpected modification or deletion of hidden files in `C:\Users\` or system folders.
## Associated Threat Actors
Ransomware Canaries are designed to detect a wide range of actors, including those mentioned in related Huntress research:
- **Akira affiliates**
- **BlackCat (ALPHV)**
- **LockBit**
- **Crux Ransomware**
- **SafePay / INC Ransomware**
## Detection Methods
- **Behavioral detection:** Monitoring for `IRP_MJ_WRITE` or `IRP_MJ_SET_INFORMATION` operations on the specific canary file paths.
- **Integrity Checking:** Periodically hashing the canary files to ensure they have not been altered.
## Mitigation Strategies
- **Endpoint Protection:** Use canaries as a secondary layer to EDR/AV solutions.
- **Hardening:** Disable unnecessary administrative shares (C$, Admin$) to slow down ransomware lateral movement toward system-level canaries.
- **User Training:** Educate staff not to delete hidden system files.
## Related Tools/Techniques
- **Honeyfiles:** General category of files used to bait attackers.
- **Crux Ransomware:** A variant noted for high encryption speed.
- **External Recon:** Complementary service for identifying attack surfaces before ransomware deployment.