RIPlace Evasion Technique exploits Windows 10 and antiviruses

Ransomware attacks are getting common nowadays. The ability to change a few lines of code and emulate the same ransomware with different names makes it a deadly weapon for hackers.

A similar process known as RIPlace Evasion technique was discovered by leading security researchers at the endpoint protection firm Nyotron. This method is effective against devices that run the latest computer security solutions and updated system patches. Read on to know more about this advanced ransomware technique.

How does the RIPlace Evasion Technique Work?

RIPlace Evasion technique was discovered by Cybersecurity experts in Nyotron around the spring of 2019. During that time, this new ransomware bypass method was not taken seriously since it was not being used for Ransomware attacks. However, the whole process is catastrophic for computing devices. Here is how it works:

• Almost all ransomwares function by opening and reading the files. Then the files are encrypted and the original files are destroyed by either renaming or replacing them.

• A special method of renaming or replacing the file is known as RIPlace Evasion technique

• The Ransomware infection uses a legacy file system “rename” operation

• Using specific coding instructions, the ransomware can then bypass modern antivirus solutions and encrypt files.

Techniques to prevent the REPlace Evasion