RT-Information Security Company of Rostec State Corporation has developed an Anti-cipher digital solution to counteract ransomware. Such software is used by cybercriminals to steal or destroy data for financial gain, as well as for espionage. The new development allows monitoring and early blocking of any operations related to files and processes when signs of malware activity are detected.
"Anti-cipher" is a new module of the domestic ecosystem for providing digital protection RT Protect EDR, created by RT-Information Security. The integration of the module with the Windows operating system kernel at the driver level allows for real-time analysis of all running processes. Malicious operations are blocked at the stage of attempting to execute them, and not after the fact. This prevents data conversion, deletion, or theft.
"Rostec organizations are involved in the most important technological projects in Russia. Almost all of our enterprises are critical information infrastructure facilities. Encryption programs pose a huge danger to such companies. A successful cyberattack can strike not just a business, causing multimillion-dollar losses, but even national security! Statistics show that the majority of cyber attacks in Russia is currently politically motivated. Their goal is not to obtain financial benefits, such as ransom for stolen data, but espionage and sabotage. "Anti—cipher will strengthen the protection of domestic enterprises from such actions," Rostec said.
The new module provides automatic forced termination of both individual malicious programs operating independently and groups of programs working together. In addition, the "Anti-cipher" automatically saves important files when they are being modified/deleted to a local secure storage. Backup works in parallel with other protective mechanisms, so that important files can be restored after a cyberattack is repelled. In case of malicious file conversion, you will not need to know the encryption keys and algorithms to restore them.
"Our new module prevents the launch of malware Software is based on regularly updated compromise indicators for domain names, IP addresses, executable file hashes, and YARA signatures. The "anti—cipher" is able to identify common characteristic behavioral signs of malware — privilege escalation, consolidation in the system, and others - at the initial stage of its operation due to an up-to-date set of attack indicators. The module also analyzes the behavior of programs in relation to files in real time and identifies characteristic signs of malicious file encryption or destruction," said Dmitry Prendetsky, General Director of RT—Information Security.
Please note that this press release is based on materials provided by the company. AK&M Information Agency shall not be held liable for its contents, nor for the legal and other consequences of its publication.
