https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/

html emsisoft.com collected 2026-09-24 08:25:55 UTC 127,076 bytes, 4 lines download raw bytes

1<!DOCTYPE html> <html lang="en-US"> <head> <meta charset="UTF-8"> <title>How ransomware attackers evade your organizationâs security</title> <link href="//www.googletagmanager.com" rel="dns-prefetch"> <link href="//www.google-analytics.com" rel="dns-prefetch"> <link href="//googleads.g.doubleclick.net" rel="dns-prefetch"> <link href="//www.google-analytics.com" rel="dns-prefetch"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-status-bar-style" content="black"> <link href="https://www.googletagmanager.com/gtm.js?id=GTM-WK8DP7" rel="preload" as="script">

1<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.defer=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-WK8DP7');</script>

1 <!--[if lt IE 9 ]>

1<script>var html5Elem = ['header', 'nav', 'menu', 'section', 'article', 'aside', 'footer'];for (var i = 0; i < html5Elem.length; i++) {document.createElement(html5Elem[i])}</script>

1 <![endif]--> <link href="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/favicon.ico?id=8d0c97e25b562df9b5546bae7953cae6" rel="icon" type="image/x-icon"> <style>abbr,address,article,aside,audio,b,blockquote,body,body div,caption,cite,code,dd,del,details,dfn,dl,dt,em,fieldset,figure,footer,form,h1,h2,h3,h4,h5,h6,header,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,p,pre,q,samp,section,small,span,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,ul,var,video{background:transparent;border:0;font-size:100%;font-weight:400;margin:0;padding:0;vertical-align:baseline}article,aside,details,figure,footer,header,nav,section,summary{display:block}html{-webkit-box-sizing:border-box;box-sizing:border-box}*,:after,:before{-webkit-box-sizing:inherit;box-sizing:inherit}embed,img,object{max-width:100%}html{overflow-y:scroll}ul{list-style:none}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}a{background:transparent;font-size:100%;margin:0;padding:0;vertical-align:baseline}del{text-decoration:line-through}abbr[title],dfn[title]{border-bottom:1px dotted #000;cursor:help}table{border-collapse:collapse;border-spacing:0}th{font-weight:700;vertical-align:bottom}td{font-weight:400;vertical-align:top}hr{border:0;border-top:1px solid #ccc;display:block;height:1px;margin:1em 0;padding:0}input,select{vertical-align:middle}pre{word-wrap:break-word;white-space:pre;white-space:pre-wrap;white-space:pre-line}input[type=radio]{vertical-align:text-bottom}input[type=checkbox]{vertical-align:bottom}input,select,textarea{font:99% sans-serif}table{font-size:inherit;font:100%}small{font-size:85%}strong{font-weight:700}td,td img{vertical-align:top}sub,sup{font-size:75%;line-height:0;position:relative}sup{top:-.5em}sub{bottom:-.25em}code,kbd,pre,samp{font-family:monospace,sans-serif}button,input[type=button],input[type=file],input[type=submit],label{cursor:pointer}button,input,select,textarea{margin:0}button,input[type=button]{overflow:visible;width:auto}*{-webkit-box-sizing:border-box;box-sizing:border-box}.main-banner img{height:250px;max-width:100%;width:auto}#content,.container{padding-left:15px;padding-right:15px}.header{-webkit-box-flex:0;background-color:#fff;border-bottom:2px solid #0385c6;-webkit-box-sizing:content-box;box-sizing:content-box;-ms-flex:none;flex:none;height:69px;position:fixed;top:0;width:100%;z-index:120}.header .container,.header .wrapper{-webkit-box-pack:justify;-ms-flex-pack:justify;display:-webkit-box;display:-ms-flexbox;display:flex;height:100%;justify-content:space-between;padding:0;width:100%}.header .wrapper{-webkit-box-pack:left;-ms-flex-pack:left;justify-content:left;padding:0 15px}.header .logo,.header .wrapper{-webkit-box-align:center;-ms-flex-align:center;align-items:center}.header .logo{height:inherit;line-height:0;margin-right:14px}.header .logo,.header .logo a{display:-webkit-box;display:-ms-flexbox;display:flex}.header .logo a{font-size:0}.header .menu-sub-about{display:inherit;position:absolute;right:15px;top:24px;-webkit-transition:top .2s;transition:top .2s}.header .menu-sub-about .login{height:38px;margin:-6px 0 0}.header .menu-sub-about .login iframe{height:38px;width:220px}.header .menu-sub-about .login .button{font-size:10pt;padding:5px 40px}.header .nav{display:inline-block;height:60px;line-height:1;position:relative;top:4px;-webkit-transition:all .2s;transition:all .2s;z-index:100}.header .nav>div{font-size:0}.header .nav ul.menu{display:-webkit-box;display:-ms-flexbox;display:flex;opacity:1;position:relative}.header .nav ul.menu>li{position:relative;white-space:nowrap}.header .nav ul.menu>li a{color:#2b3438}.header .nav ul.menu>li.menu-item-has-children>a{padding-right:32px}.header .nav ul.menu>li>a{-webkit-backface-visibility:hidden;backface-visibility:hidden;border-bottom:2px solid transparent;-webkit-box-shadow:0 0 3px 1px rgba(0,0,0,0);box-shadow:0 0 3px 1px rgba(0,0,0,0);display:block;font-family:Segoe UI,Segoe UI E,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;font-size:17px;font-weight:600;padding:20px 24px 23px;text-decoration:none;text-transform:none;-webkit-transition:border-bottom-color .2s ease-in-out,color .2s ease-in-out,-webkit-box-shadow .2s ease-in-out;transition:border-bottom-color .2s ease-in-out,color .2s ease-in-out,-webkit-box-shadow .2s ease-in-out;transition:border-bottom-color .2s ease-in-out,color .2s ease-in-out,box-shadow .2s ease-in-out;transition:border-bottom-color .2s ease-in-out,color .2s ease-in-out,box-shadow .2s ease-in-out,-webkit-box-shadow .2s ease-in-out;white-space:nowrap}.header .hamburger{display:none}@media only screen and (max-width:560px){.main-banner img{height:200px}img{height:auto;max-width:100%}body{margin:0}body .header{height:53px}body .header .logo .logo-emsisoft img{display:block;width:110px}body .header .logo .logo-sub{margin-top:9px}body .header .logo .logo-sub:before{bottom:-10px;height:45px}body .header .logo .logo-sub img{height:24px}}@media only screen and (max-width:1199px){.header .menu-sub-about{display:none}.header .nav ul.menu{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column;margin-bottom:50px;width:100%}.header .nav ul.menu>

1li>a{line-height:50px;padding:0 30px;width:100%}.header{height:71px}.header .nav{-webkit-font-smoothing:antialiased;height:calc(100vh - 55px);overflow:hidden;position:absolute;top:55px;-webkit-transform:translate(120%);-ms-transform:translate(120%);transform:translate(120%);-webkit-transform-origin:0 0;-ms-transform-origin:0 0;transform-origin:0 0;-webkit-transition:-webkit-transform 0s linear 1s;transition:-webkit-transform 0s linear 1s;transition:transform 0s linear 1s;transition:transform 0s linear 1s,-webkit-transform 0s linear 1s;width:100%;z-index:10}.header .nav:before{background-color:hsla(192,6%,66%,0);bottom:0;content:"";height:100%;left:0;position:absolute;right:0;top:0;-webkit-transition:background-color .4s ease-in-out;transition:background-color .4s ease-in-out;width:100%}.header .nav>div{background-color:#fdf8f4;height:100%;margin-left:auto;-webkit-transform:translate(120%);-ms-transform:translate(120%);transform:translate(120%);-webkit-transition:-webkit-transform .4s cubic-bezier(.77,.2,.05,1);transition:-webkit-transform .4s cubic-bezier(.77,.2,.05,1);transition:transform .4s cubic-bezier(.77,.2,.05,1);transition:transform .4s cubic-bezier(.77,.2,.05,1),-webkit-transform .4s cubic-bezier(.77,.2,.05,1);width:90%}.header .nav>div.search__wrapper{display:block;height:38px}.header .nav>div.search__wrapper .search__icon.is-button{height:37px;right:0}.header .nav>div.search__wrapper .search__on-opened:before{left:16px}.header .wrapper{-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.header .hamburger{background-color:transparent;border:0;-webkit-box-sizing:content-box;box-sizing:content-box;cursor:pointer;display:inline-block;font:inherit;height:20px;margin:0;outline:0;padding:15px 12px}.header .hamburger .hamburger-box{display:inline-block;height:20px;position:relative;width:30px}.header .hamburger .hamburger-inner{background-color:#0385c6;border-radius:4px;display:block;height:3px;position:absolute;top:50%;width:30px}.header .hamburger .hamburger-inner:after,.header .hamburger .hamburger-inner:before{background-color:#0385c6;border-radius:4px;content:"";display:block;height:3px;position:absolute;width:30px}.header .hamburger .hamburger-inner:before{top:-8px}.header .hamburger .hamburger-inner:after{top:9px}} a{color:inherit;text-decoration:none}img{display:block;height:auto;max-width:100%}body,html{height:100%}body{-webkit-box-orient:vertical;-webkit-box-direction:normal;color:#2b3438;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-direction:column;flex-direction:column;font-family:Segoe UI,Segoe UI E,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;padding-top:71px}body.cookieconsent .help-messenger-btn,body.cookieconsent .zsiq_floatmain,body.cookieconsent-open .help-messenger-btn,body.cookieconsent-open .zsiq_floatmain{bottom:80px!important}.flex-container{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-box-align:start;-ms-flex-align:start;align-items:flex-start;display:-webkit-box!important;display:-ms-flexbox!important;display:flex!important;-ms-flex-direction:row;flex-direction:row}.flex-container .one-third{-ms-flex-preferred-size:31.623931623931625%;flex-basis:31.623931623931625%}.flex-container .two-thirds{-ms-flex-preferred-size:65.81196581196582%;flex-basis:65.81196581196582%}#content{min-height:200px}.h1,.h2,.h3,.h4,.h5,.h6,h1,h2,h3,h4,h5,h6{font-family:HK Grotesk,sans-serif;font-weight:700}#content,.container,main>section>.wp-block-columns,main>section>article>.wp-block-columns{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0 auto;max-width:1320px;position:relative;width:100%}#content.is-slim,.container.is-slim,main>section>.wp-block-columns.is-slim,main>section>article>.wp-block-columns.is-slim{max-width:1070px}.screen-reader-text{display:none}.main-container{-webkit-box-flex:1;-ms-flex:1 0 auto;flex:1 0 auto}.icon{fill:currentColor}.icon-envelope:hover{background-color:#58676b;color:#fff}.icon-xing:hover{background-color:#026466;color:#fff}.category-nav{display:none}.category-nav ul{-ms-flex-pack:justify;-webkit-box-pack:justify;display:-webkit-box;display:-ms-flexbox;display:flex;justify-content:space-between}.category-nav li{line-height:3.85;padding:0 1em;-webkit-transition:line-height .2s;transition:line-height .2s;vertical-align:middle}.category-nav li.current-category-ancestor a,.category-nav li.current-category-ancestor:hover a,.category-nav li.current-menu-item a,.category-nav li.current-menu-item:hover a{color:#0385c6}.category-nav li:first-child{padding-left:0}.category-nav li:last-child{padding-right:0}.category-nav li a{color:#58676b;cursor:pointer;display:block;font-weight:400;-webkit-transition:color .2s;transition:color .2s}.category-nav li a:hover{color:#9facb0}.section-nav-stick .category-nav li{line-height:3}.bg-img{background-position:50% 50%;background-repeat:no-repeat;background-size:contain}.has-error label{color:#d84315!important}.p10{padding:10px}.p10-0{padding:10px 0}.p20{padding:20px}.p20-0{padding:20px 0}.ttn,.ttn>a{text-transform:none!important}.text-center{text-align:center!important}.text-green{color:#37a43c}.text-orange{color:#f58634}#post-404 .content{padding:40px 0}.wpsr-text-sb.wpsr-tsb-active{-webkit-animation:wpsr-fadein .3s!important;animation:wpsr-fadein .3s!important}.shake{-webkit-animation:shake 1s;animation:shake 1s}.browser-safari input[type=search]{-webkit-appearance:textfield}.post-edit-link{color:#0385c6;display:inline-block;margin:8px 0;text-decoration:underline}.desktop-only,.mobile-only{display:none}.grecaptcha-badge{visibility:hidden}.cky-btn-revisit-wrapper{display:none!important}@-webkit-keyframes shake{0%,to{-webkit-transform:translateZ(0);transform:translateZ(0)}10%,30%,50%,70%,90%{-webkit-transform:translate3d(-6px,0,0);transform:translate3d(-6px,0,0)}20%,40%,60%,80%{-webkit-transform:translate3d(6px,0,0);transform:translate3d(6px,0,0)}}@keyframes shake{0%,to{-webkit-transform:translateZ(0);transform:translateZ(0)}10%,30%,50%,70%,90%{-webkit-transform:translate3d(-6px,0,0);transform:translate3d(-6px,0,0)}20%,40%,60%,80%{-webkit-transform:translate3d(6px,0,0);transform:translate3d(6px,0,0)}}.columns,.wp-block-columns{display:-webkit-box;display:-ms-flexbox;display:flex}.columns.is-down,.wp-block-columns.is-down{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.columns.is-wrap,.wp-block-columns.is-wrap{-ms-flex-wrap:wrap;flex-wrap:wrap}.columns.is-centered,.wp-block-columns.is-centered{-webkit-box-pack:center;-ms-flex-pack:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;justify-content:center}.columns.is-aligned-down,.wp-block-columns.is-aligned-down{-webkit-box-align:end;-ms-flex-align:end;align-items:flex-end}.columns.has-2col,.wp-block-columns.has-2col{-webkit-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between}.columns.has-2col .column,.columns.has-2col .wp-block-column,.wp-block-columns.has-2col .column,.wp-block-columns.has-2col .wp-block-column{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:calc(50% - 15px)}.columns.has-3col .column,.columns.has-3col .wp-block-column,.wp-block-columns.has-3col .column,.wp-block-columns.has-3col .wp-block-column{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:33.333333333%}.columns.has-4col .column,.columns.has-4col .wp-block-column,.wp-block-columns.has-4col .column,.wp-block-columns.has-4col .wp-block-column{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:25%}.columns.has-half,.wp-block-columns.has-half{-ms-flex-wrap:wrap;flex-wrap:wrap}.columns.has-half .column,.columns.has-half .wp-block-column,.wp-block-columns.has-half .column,.wp-block-columns.has-half .wp-block-column{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:50%}.columns.has-half .column.has-pl,.columns.has-half .wp-block-column.has-pl,.wp-block-columns.has-half .column.has-pl,.wp-block-columns.has-half .wp-block-column.has-pl{padding-left:40px}.columns .column,.columns .wp-block-column,.wp-block-columns .column,.wp-block-columns .wp-block-column{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;width:100%}.columns .column.one-third,.columns .wp-block-column.one-third,.wp-block-columns .column.one-third,.wp-block-columns .wp-block-column.one-third{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:33.333333333%}.columns .column.two-third,.columns .wp-block-column.two-third,.wp-block-columns .column.two-third,.wp-block-columns .wp-block-column.two-third{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;width:66.666666666%}.columns .column.content-vertical-align,.columns .wp-block-column.content-vertical-align,.

1wp-block-columns .column.content-vertical-align,.wp-block-columns .wp-block-column.content-vertical-align{-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-box-pack:center;-ms-flex-pack:center;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-direction:column;flex-direction:column;justify-content:center}.columns .wp-block-column,.wp-block-columns .wp-block-column{-webkit-box-flex:1;-ms-flex:1 1 0px;flex:1 1 0}.grid{grid-column-gap:35px;grid-row-gap:35px;display:grid}.grid.has-2col,.grid.has-half{grid-template-columns:repeat(2,1fr)}.grid.has-3col{grid-template-columns:repeat(3,1fr)}.grid.has-4col{grid-template-columns:repeat(4,1fr)}body.admin-bar .header{top:32px}.header{-webkit-box-flex:0;background-color:#fff;border-bottom:2px solid #0385c6;-webkit-box-sizing:content-box;box-sizing:content-box;-ms-flex:none;flex:none;font-family:Segoe UI,Segoe UI E,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;height:69px;position:fixed;top:0;-webkit-transition:all .2s;transition:all .2s;width:100%;z-index:120}.header .cta .button{opacity:0;position:absolute;top:-1000px}.header .logo .logo-emsisoft img{width:138px}.header .logo .logo-sub{margin:12px 0 0 26px;position:relative;-webkit-transition:margin .2s;transition:margin .2s}.header .logo .logo-sub:before{background-color:#f58634;bottom:-14px;content:"";display:block;height:58px;left:-14px;position:absolute;-webkit-transition:top .2s;transition:top .2s;width:2px}.header .logo .logo-sub img{-ms-flex-item-align:end;align-self:flex-end;display:-webkit-box;display:-ms-flexbox;display:flex;height:29px}.header .logo img{display:block}.header .container{display:-webkit-box;display:-ms-flexbox;display:flex;height:100%;position:relative}.header .cta{-ms-flex-item-align:center;align-self:center;bottom:-13px;display:none;line-height:1;margin-left:auto;padding:10px 0;position:relative;-webkit-transition:all .2s;transition:all .2s}.header .button{background-color:#0385c6;border-radius:3px;color:#fff;font-size:10pt;padding:10px 30px;text-transform:uppercase;-webkit-transition:top 0s ease-in-out .5s,opacity .2s,background-color .1s;transition:top 0s ease-in-out .5s,opacity .2s,background-color .1s;white-space:nowrap}.header .button:hover{background-color:#04a9fb}.header .button button{border:none;outline:none}.header .nav .search__wrapper{display:none}.header .nav ul.menu:before{background:transparent;bottom:0;content:"";height:0;left:0;position:absolute;right:0;top:0;width:0;z-index:1}.header .nav ul.menu>li.current-menu-item>a,.header .nav ul.menu>li.current-menu-parent>a{color:#0385c6}.header .nav ul.menu>li:hover>a{color:#0385c6!important}.header .nav ul.menu>li:hover>ul{height:auto;opacity:1;overflow:visible;-webkit-transform:translateY(.5px);-ms-transform:translateY(.5px);transform:translateY(.5px)}.header .nav ul.menu>li.menu-item-has-children>a{position:relative}.header .nav ul.menu>li.menu-item-has-children>a:after,.header .nav ul.menu>li.menu-item-has-children>a:before{background-color:#2b3438;border-radius:2px;content:"";display:inline-block;height:1px;pointer-events:none;position:absolute;right:14.5px;top:calc(50% - .5px);-webkit-transform:rotate(-45deg) translateY(0);-ms-transform:rotate(-45deg) translateY(0);transform:rotate(-45deg) translateY(0);-webkit-transition:background-color .2s ease-in,-webkit-transform .2s ease-in-out;transition:background-color .2s ease-in,-webkit-transform .2s ease-in-out;transition:background-color .2s ease-in,transform .2s ease-in-out;transition:background-color .2s ease-in,transform .2s ease-in-out,-webkit-transform .2s ease-in-out;width:7px}.header .nav ul.menu>li.menu-item-has-children>a:hover:after,.header .nav ul.menu>li.menu-item-has-children>a:hover:before{background-color:#0385c6;-webkit-transform:rotate(-45deg) translateX(-.5px) translateY(.5px);-ms-transform:rotate(-45deg) translateX(-.5px) translateY(.5px);transform:rotate(-45deg) translateX(-.5px) translateY(.5px)}.header .nav ul.menu>li.menu-item-has-children>a:hover:after{-webkit-transform:rotate(45deg) translateX(.5px) translateY(.5px);-ms-transform:rotate(45deg) translateX(.5px) translateY(.5px);transform:rotate(45deg) translateX(.5px) translateY(.5px)}.header .nav ul.menu>

1li.menu-item-has-children>a:after{right:19px;-webkit-transform:rotate(45deg);-ms-transform:rotate(45deg);transform:rotate(45deg)}.header .nav ul.menu>li>ul{-webkit-backface-visibility:hidden;backface-visibility:hidden;background-color:#fff;border:1px solid hsla(195,8%,48%,.25);border-radius:16px;-webkit-box-shadow:2px 2px 14px hsla(195,8%,48%,.3);box-shadow:2px 2px 14px hsla(195,8%,48%,.3);height:0;left:0;min-width:100%;opacity:0;overflow:hidden;position:absolute;top:calc(100% - 8px);-webkit-transform:translateY(1.5px);-ms-transform:translateY(1.5px);transform:translateY(1.5px);-webkit-transition:-webkit-transform .1s ease-in-out;transition:-webkit-transform .1s ease-in-out;transition:transform .1s ease-in-out;transition:transform .1s ease-in-out,-webkit-transform .1s ease-in-out}.header .nav ul.menu>li>ul li{position:relative;-webkit-transition:background .2s ease-in-out;transition:background .2s ease-in-out}.header .nav ul.menu>li>ul li.current-menu-item a{color:#0385c6}.header .nav ul.menu>li>ul li:hover a{color:#0385c6!important}.header .nav ul.menu>li>ul li a{display:block;font-size:16px;padding:18px 14px;text-decoration:none;text-transform:none;-webkit-transition:color .1s ease-in-out;transition:color .1s ease-in-out;white-space:nowrap}.header .nav ul.menu>li>ul li.border-top{border-top:1px solid #eef0f0}.single .header .nav-about .menu>li ul li:not(.no-translation){display:inherit}body.section-nav-stick .category-nav{margin-bottom:0;position:fixed;top:71px;-webkit-transition:top .2s;transition:top .2s;width:100%;z-index:90}body.section-nav-stick.admin-bar .category-nav{top:103px}body.section-nav-stick.admin-bar.has-promo.promo-bar .category-nav{top:162px}body.section-nav-stick.has-promo .category-nav,body.section-nav-stick.promo-above .category-nav,body.section-nav-stick.promo-bar .category-nav{top:115px}.browser-safari .header .nav ul.menu>li>a{font-weight:500}html[lang=de-DE] .browser-safari .header .menu-sub-about .login iframe{width:270px}html[lang=fr-FR] .browser-safari .header .menu-sub-about .login iframe{width:250px}html[lang=de-DE] .header .menu-sub-about .login iframe{width:260px}html[lang=fr-FR] .header .menu-sub-about .login iframe{width:250px}.hamburger{background-color:transparent;border:0;color:inherit;cursor:pointer;display:inline-block;font:inherit;margin:0;overflow:visible;padding:15px;position:relative;text-transform:none;-webkit-transition-duration:.15s;transition-duration:.15s;transition-property:opacity,-webkit-filter;-webkit-transition-property:opacity,-webkit-filter;transition-property:opacity,filter;transition-property:opacity,filter,-webkit-filter;-webkit-transition-timing-function:linear;transition-timing-function:linear;z-index:30}.hamburger:hover{opacity:.7}.hamburger-box{display:inline-block;height:20px;position:relative;width:30px}.hamburger-inner{display:block;margin-top:-2px;top:50%}.hamburger-inner,.hamburger-inner:after,.hamburger-inner:before{background-color:#000;border-radius:4px;height:3px;position:absolute;-webkit-transition-duration:.15s;transition-duration:.15s;transition-property:-webkit-transform;-webkit-transition-property:-webkit-transform;transition-property:transform;transition-property:transform,-webkit-transform;-webkit-transition-timing-function:ease;transition-timing-function:ease;width:30px}.hamburger-inner:after,.hamburger-inner:before{content:"";display:block}.hamburger-inner:before{top:-10px}.hamburger-inner:after{bottom:-10px}.hamburger--collapse .hamburger-inner{bottom:0;top:auto;-webkit-transition-delay:.15s;transition-delay:.15s;-webkit-transition-duration:.15s;transition-duration:.15s;-webkit-transition-timing-function:cubic-bezier(.55,.055,.675,.19);transition-timing-function:cubic-bezier(.55,.055,.675,.19)}.hamburger--collapse .hamburger-inner:after{top:-20px;-webkit-transition:top .3s cubic-bezier(.33333,.66667,.66667,1) .3s,opacity .1s linear;transition:top .3s cubic-bezier(.33333,.66667,.66667,1) .3s,opacity .1s linear}.hamburger--collapse .hamburger-inner:before{transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,-webkit-transform .15s cubic-bezier(.55,.055,.675,.19);-webkit-transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,-webkit-transform .15s cubic-bezier(.55,.055,.675,.19);transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,transform .15s cubic-bezier(.55,.055,.675,.19);transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,transform .15s cubic-bezier(.55,.055,.675,.19),-webkit-transform .15s cubic-bezier(.55,.055,.675,.19)}.nav-is-active .hamburger--collapse .hamburger-inner{-webkit-transform:translateZ(0) rotate(-45deg);transform:translateZ(0) rotate(-45deg);-webkit-transition-delay:.32s;transition-delay:.32s;-webkit-transition-timing-function:cubic-bezier(.215,.61,.355,1);transition-timing-function:cubic-bezier(.215,.61,.355,1)}.nav-is-active .hamburger--collapse .hamburger-inner:after{opacity:0;top:0;-webkit-transition:top .3s cubic-bezier(.33333,0,.66667,.33333),opacity .1s linear .27s;transition:top .3s cubic-bezier(.33333,0,.66667,.33333),opacity .1s linear .27s}.nav-is-active .hamburger--collapse .hamburger-inner:before{top:0;-webkit-transform:rotate(-90deg);-ms-transform:rotate(-90deg);transform:rotate(-90deg);transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,-webkit-transform .15s cubic-bezier(.215,.61,.355,1) .42s;-webkit-transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,-webkit-transform .15s cubic-bezier(.215,.61,.355,1) .42s;transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,transform .15s cubic-bezier(.215,.61,.355,1) .42s;transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,transform .15s cubic-bezier(.215,.61,.355,1) .42s,-webkit-transform .15s cubic-bezier(.215,.61,.355,1) .42s}.hamburger--collapse-r .hamburger-inner{bottom:0;top:auto;-webkit-transition-delay:.15s;transition-delay:.15s;-webkit-transition-duration:.15s;transition-duration:.15s;-webkit-transition-timing-function:cubic-bezier(.55,.055,.675,.19);transition-timing-function:cubic-bezier(.55,.055,.675,.19)}.hamburger--collapse-r .hamburger-inner:after{top:-20px;-webkit-transition:top .3s cubic-bezier(.33333,.66667,.66667,1) .3s,opacity .1s linear;transition:top .3s cubic-bezier(.33333,.66667,.66667,1) .3s,opacity .1s linear}.hamburger--collapse-r .hamburger-inner:before{transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,-webkit-transform .15s cubic-bezier(.55,.055,.675,.19);-webkit-transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,-webkit-transform .15s cubic-bezier(.55,.055,.675,.19);transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,transform .15s cubic-bezier(.55,.055,.675,.19);transition:top .12s cubic-bezier(.33333,.66667,.66667,1) .3s,transform .15s cubic-bezier(.55,.055,.675,.19),-webkit-transform .15s cubic-bezier(.55,.055,.675,.19)}.nav-is-active .hamburger--collapse-r .hamburger-inner{-webkit-transform:translate3d(0,-10px,0) rotate(45deg);transform:translate3d(0,-10px,0) rotate(45deg);-webkit-transition-delay:.32s;transition-delay:.32s;-webkit-transition-timing-function:cubic-bezier(.215,.61,.355,1);transition-timing-function:cubic-bezier(.215,.61,.355,1)}.nav-is-active .hamburger--collapse-r .hamburger-inner:after{opacity:0;top:0;-webkit-transition:top .3s cubic-bezier(.33333,0,.66667,.33333),opacity .1s linear .27s;transition:top .3s cubic-bezier(.33333,0,.66667,.33333),opacity .1s linear .27s}.nav-is-active .hamburger--collapse-r .hamburger-inner:before{top:0;-webkit-transform:rotate(90deg);-ms-transform:rotate(90deg);transform:rotate(90deg);transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,-webkit-transform .15s cubic-bezier(.215,.61,.355,1) .42s;-webkit-transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,-webkit-transform .15s cubic-bezier(.215,.61,.355,1) .42s;transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,transform .15s cubic-bezier(.215,.61,.355,1) .42s;transition:top .12s cubic-bezier(.33333,0,.66667,.33333) .18s,transform .15s cubic-bezier(.215,.61,.355,1) .42s,-webkit-transform .15s cubic-bezier(.215,.61,.355,1) .42s}@font-face{font-display:swap;font-family:fontello;font-style:normal;font-weight:400;src:url(/wp-content/themes/emsisoft_base/dist/fonts/icons/fontello.eot?1879);src:url(/wp-content/themes/emsisoft_base/dist/fonts/icons/fontello.eot?1879#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/fontello.woff2?1879) format("woff2"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/fontello.woff?1879) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/fontello.ttf?1879) format("truetype"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/fontello.svg?1879#fontello) format("svg")}@font-face{font-display:block;font-family:icomoon;font-style:normal;font-weight:400;src:url(/wp-content/themes/emsisoft_base/dist/fonts/icons/icomoon.eot?fumq73);src:url(/wp-content/themes/emsisoft_base/dist/fonts/icons/icomoon.eot?fumq73#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/icomoon.ttf?fumq73) format("truetype"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/icomoon.woff?fumq73) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/icons/icomoon.svg?fumq73#icomoon) format("svg")}@font-face{font-display:swap;font-family:Segoe UI E;font-style:normal;font-weight:400;src:url(/wp-content/themes/emsisoft_base/dist/fonts/SegoeUI/SegoeUI.eot);src:local("Segoe UI"),local("SegoeUI"),url(/wp-content/themes/emsisoft_base/dist/fonts/SegoeUI/SegoeUI.eot?#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/SegoeUI/SegoeUI.woff2) format("woff2"),url(/wp-content/themes/emsisoft_base/dist/fonts/SegoeUI/SegoeUI.woff) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/SegoeUI/SegoeUI.svg#SegoeUI) format("svg")}@font-face{font-display:swap;font-family:HK Grotesk;font-style:normal;font-weight:400;src:url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Regular.eot);

1src:local("HK Grotesk Regular"),local("HKGrotesk-Regular"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Regular.eot?#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Regular.woff2) format("woff2"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Regular.woff) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Regular.ttf) format("truetype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Regular.svg#HKGrotesk-Regular) format("svg")}@font-face{font-display:swap;font-family:HK Grotesk;font-style:normal;font-weight:100;src:url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Light.eot);src:local("HK Grotesk Light"),local("HKGrotesk-Light"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Light.eot?#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Light.woff2) format("woff2"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Light.woff) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Light.ttf) format("truetype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Light.svg#HKGrotesk-Light) format("svg")}@font-face{font-display:swap;font-family:HK Grotesk;font-style:normal;font-weight:500;src:url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Medium.eot);src:local("HK Grotesk Medium"),local("HKGrotesk-Medium"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Medium.eot?#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Medium.woff2) format("woff2"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Medium.woff) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Medium.ttf) format("truetype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Medium.svg#HKGrotesk-Medium) format("svg")}@font-face{font-display:swap;font-family:HK Grotesk;font-style:normal;font-weight:700;src:url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.eot);src:local("HK Grotesk Bold"),local("HKGrotesk-Bold"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.eot?#iefix) format("embedded-opentype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.woff2) format("woff2"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.woff) format("woff"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.ttf) format("truetype"),url(/wp-content/themes/emsisoft_base/dist/fonts/hkgrotesk/HKGrotesk-Bold.svg#HKGrotesk-Bold) format("svg")}[data-scrollTo]{cursor:pointer}img.shadow-raised{-webkit-box-shadow:0 13px 21px -10px rgba(0,0,0,.3),0 1px 4px rgba(0,0,0,.3);box-shadow:0 13px 21px -10px rgba(0,0,0,.3),0 1px 4px rgba(0,0,0,.3)}.invisible{display:none}.flex-4{-webkit-box-flex:4!important;-ms-flex:4!important;flex:4!important}.ml1{margin-left:1em}.ml2{margin-left:2em}.ml3{margin-left:3em}.mr1{margin-right:1em}.mr2{margin-right:2em}.mb0{margin-bottom:0!important}.mb05{margin-bottom:.5em}.mb1{margin-bottom:1em}.mb2{margin-bottom:2em}.mb4{margin-bottom:4em}.mt0{margin-top:0!important}.mt1{margin-top:1em}.mt2{margin-top:2em}.mt4{margin-top:4em}.m-center{margin-left:auto;margin-right:auto}.pb-0,.pb0{padding-bottom:0!important}.pt0{padding-top:0!important}.w65{width:65%}.left{float:left}.alignright,.text-right{text-align:right}.alignleft,.text-left{text-align:left}.clickable{cursor:pointer}.aligncenter,.text-center{text-align:center}.text-small{font-size:14px}.text-italic{font-style:italic}.text-green{color:#37a43c!important}.text-orange{color:#f58634!important}.text-blue{color:#0385c6!important}.nw{white-space:nowrap}.with-border{border:1px solid #d1d8df;padding:15px}.border_bottom{border-bottom:1px solid #f6f7f7}.transparent{background-color:transparent;color:transparent;opacity:0;visibility:hidden}.fadeInDown{-webkit-animation-duration:1s;animation-duration:1s;-webkit-animation-fill-mode:both;animation-fill-mode:both;-webkit-animation-name:fadeInDown;animation-name:fadeInDown}.animate{opacity:0;visibility:hidden}@-webkit-keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInDown{0%{opacity:0;-webkit-transform:translate3d(0,-100%,0);transform:translate3d(0,-100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}.newsletter{background-color:#f6f7f7;padding:42px 0;text-align:center}.newsletter .container.is-slim{max-width:900px}.newsletter h3,.newsletter__title{color:#0385c6;font-size:32px;font-weight:600}.newsletter svg{fill:currentColor;display:block;height:1.5em;margin:0 auto .5em;max-width:100%}.newsletter__text{margin:1.6em auto}.newsletter form{grid-gap:10px;display:grid;grid-template-columns:repeat(3,1fr)}.newsletter button,.newsletter input[type=email],.newsletter input[type=text]{border-radius:4px;cursor:pointer;line-height:58px;padding:0 20px}.newsletter input{border:1px solid #fafafa}.newsletter .emails-opt-wrapper{grid-column-end:4;grid-column-start:1;margin:0}.button[disabled],.button[disabled]:hover,.disabled>.button{background-color:#fafafa!important;border-color:#fafafa!important;color:#fff!important;cursor:not-allowed}.button{background:#0385c6;border:none;border-radius:4px;color:#fff;display:inline-block;font-family:HK Grotesk,sans-serif;font-size:17px;font-style:normal;line-height:40px;min-width:192px;outline:0;padding:0 20px;text-align:center;text-decoration:none!important;-webkit-transition:background-color .2s,color .2s,border-color .2s;transition:background-color .2s,color .2s,border-color .2s;white-space:nowrap}.button,.button span{font-weight:700}.button.is-compact{font-size:19px;padding:0 8px}.button.is-small{font-size:15px;line-height:38px}.button:hover{background:#04a9fb;color:#fff}.button.share{font-size:20px;font-weight:500;line-height:51px;padding:0 40px 2px 60px;position:relative;text-align:center;text-transform:none}.button.share:hover{opacity:.8}.button.share.facebook{background-color:#3e5b98!important}.button.share.facebook:before{speak:none;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;content:"\f09a";font-family:fontello;font-style:normal;font-variant:normal;font-weight:400;left:20px;line-height:1;position:absolute;text-transform:none;top:15px}.button.share.twitter{background-color:#4da7de!important}.button.share.twitter:before{speak:none;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;content:"\f099";font-family:fontello;font-style:normal;font-variant:normal;font-weight:400;left:20px;line-height:1;position:absolute;text-transform:none;top:15px}.button.is-green{background-color:#37a43c}.button.is-green:hover{background:#4dc753;color:#fff}.button.is-orange{background-color:#f58634}.button.is-orange:hover{background:#faaf30;color:#fff}.button.is-orange.is-outlined{background-color:#fff;border:1px solid #f58634;color:#f58634}.button.is-orange.is-outlined:hover{color:#faaf30}.button.is-outlined{background-color:#fff;border:1px solid #0385c6;color:#0385c6}.button.is-outlined:hover{color:#04a9fb}.button.is-text{background-color:initial;color:#0385c6;font-size:16px}.button.is-text:hover{color:#04a9fb;text-decoration:underline!important}.button.is-preloader{margin-bottom:0;min-height:50px;position:relative}.button.is-preloader span{left:0;line-height:50px;opacity:1;position:relative;top:0;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1);-webkit-transition:opacity .2s ease-in-out,-webkit-transform .2s ease-in-out;transition:opacity .2s ease-in-out,-webkit-transform .2s ease-in-out;transition:opacity .2s ease-in-out,transform .2s ease-in-out;transition:opacity .2s ease-in-out,transform .2s ease-in-out,-webkit-transform .2s ease-in-out;width:100%}.button.is-preloader .loader{display:none;left:50%;margin-left:-6px;margin-top:-6px;opacity:0;position:absolute;top:50%;-webkit-transition:opacity .2s ease-in-out;transition:opacity .2s ease-in-out;z-index:0}.button.is-preloader.loading span{opacity:0;-webkit-transform:scale(.6);-ms-transform:scale(.6);transform:scale(.6)}.button.is-preloader.loading .loader{display:block;opacity:1;z-index:1}.button.is-preloader.is-small{min-height:38px}.button.is-preloader.is-small span{font-weight:500;line-height:38px}.button-center{max-width:-webkit-fit-content;max-width:-moz-fit-content;max-width:fit-content}.button-center,.button-center .button-wrapper{margin-left:auto!important;margin-right:auto!important}.button-group{-webkit-box-pack:normal;-ms-flex-pack:normal;-webkit-column-gap:15px;-moz-column-gap:15px;column-gap:15px;

1display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-wrap:wrap;flex-wrap:wrap;justify-content:normal;width:100%}.button-group.share{-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center}.button-group.share .button{-webkit-box-flex:0;-ms-flex-positive:0;flex-grow:0}.button-group.one-button{width:-webkit-fit-content;width:-moz-fit-content;width:fit-content}.button-group .button-wrapper{-webkit-box-flex:inherit;-ms-flex:inherit;flex:inherit}.button-group.is-half{width:50%}.button-group.is-original{-webkit-box-pack:start;-ms-flex-pack:start;justify-content:flex-start}.button-group.is-original .button{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto}.button-group.has-small .button{font-size:16px;line-height:1;min-width:150px;padding:1em}.button-group.has-small .button.is-text{font-weight:400;text-transform:inherit}.button-group.has-large .button-wrapper .button{font-size:18px;line-height:58px;min-width:300px;padding:0 20px}.button-group .button-wrapper{-webkit-box-flex:0;-ms-flex:0 0 auto;flex:0 0 auto;position:relative}.button-group .button-wrapper.two-lines:last-child{margin:0 5px}.button-group .button-wrapper.two-lines p{bottom:-34px}.button-group .button-wrapper .button{width:100%}.button-group .button-wrapper p{bottom:-24px;color:#69787d;font-family:Segoe UI,Segoe UI E,-apple-system,BlinkMacSystemFont,Roboto,Oxygen,Ubuntu,Cantarell,Fira Sans,Droid Sans,Helvetica Neue,sans-serif;left:0;margin:0 auto;position:absolute;right:0;text-align:center}.button-group .button-wrapper p,.button-group .button-wrapper p a{font-size:14px;line-height:1.3}.button-group .button-wrapper p a:hover{color:#0385c6}.show-more{background-color:#fff;margin-top:32px;position:relative;text-align:center}.show-more.with-pagination{margin-bottom:32px}.show-more:before{background-color:#fafafa;bottom:21px;content:"";display:block;height:1px;left:0;position:absolute;width:100%;z-index:0}.show-more a{font-weight:400;min-width:110px;text-transform:none}.show-more a:after,.show-more a:before{background-color:#fff;content:"";display:block;height:38px;position:absolute;top:0;width:14px}.show-more a:before{left:-15px}.show-more a:after{right:-15px}.show-more.loading span{opacity:0;-webkit-transform:scale(.6);-ms-transform:scale(.6);transform:scale(.6)}.show-more.loading .loader{display:block;opacity:1;z-index:1}.loader,.loader:after{border-radius:50%;height:12px;width:12px}.loader{-webkit-animation:load8 .7s linear infinite;animation:load8 .7s linear infinite;border:2px solid hsla(0,0%,100%,.2);border-left-color:#fff;font-size:0;left:50%;margin:-8px 0 0 -8px;position:absolute;text-indent:-9999em;top:50%;-webkit-transform:translateZ(0);transform:translateZ(0)}.is-outlined .loader{border:2px solid rgba(3,133,198,.2);border-left-color:#0385c6}.is-outlined.is-orange .loader{border-left-color:#f58634}@-webkit-keyframes load8{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}@keyframes load8{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}[class*=" icon-"]:before,[class^=icon-]:before{speak:never;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;display:inline-block;font-family:icomoon;font-style:normal;font-variant:normal;font-weight:400;line-height:1em;margin-left:.2em;margin-right:.2em;text-align:center;text-decoration:inherit;text-transform:none;width:1em}.icon-search:before{content:"\e800"}.icon-envelope:before{content:"\e801"}.icon-chat:before{content:"\e802"}.icon-zoom-in:before{content:"\e803"}.icon-minus:before{content:"\e804"}.icon-ok:before{content:"\e805"}.icon-twitter:before{content:"\f099"}.icon-facebook:before{content:"\f09a"}.icon-rss:before{content:"\f09e"}.icon-linkedin:before{content:"\f0e1"}.icon-xing:before{content:"\f168"}.icon-youtube:before{content:"\f16a"}.icon-instagram:before{content:"\f16d"}.icon-windows:before{content:"\f17a"}.icon-twitter-x:before{content:"\e900"}.type-video .section-title{color:#0385c6;font-size:22px;position:absolute;width:-webkit-max-content;width:-moz-max-content;width:max-content}.type-video>a:after,.type-video>a:before{-webkit-box-sizing:border-box;box-sizing:border-box;content:"";display:block;position:relative;-webkit-transition:background-color .2s ease-in-out;transition:background-color .2s ease-in-out}.type-video>a:before{padding-top:56.4%;width:100%}.type-video>a:hover:before{background-color:rgba(0,0,0,.3);z-index:1}.type-video>a:hover:after{background:transparent;border-color:transparent transparent transparent #fff;border-style:solid;border-width:27px 0 27px 40px;bottom:0;cursor:pointer;height:44px;left:50%;position:absolute;right:0;top:50%;-webkit-transform:translate(-50%,-50%);-ms-transform:translate(-50%,-50%);transform:translate(-50%,-50%);width:0;z-index:2}.type-video>a>img,.type-video>a>object{background-color:rgba(0,0,0,0);bottom:0;-webkit-box-shadow:none;box-shadow:none;cursor:pointer;display:block;left:0;max-height:100%;max-width:100%;position:absolute;right:0;top:0;-webkit-transition:background-color .2s;transition:background-color .2s}.type-video>a>img.black-bars,.type-video>a>object.black-bars{top:-16.45%}.has-cards.lg .type-video a{width:100%}.CTA{background-color:#0385c6;border-radius:3px;-webkit-box-sizing:border-box;box-sizing:border-box;margin:1.6em auto;min-height:190px;overflow:hidden;padding:35px;position:relative}.CTA__Body{-webkit-box-orient:vertical;-webkit-box-direction:normal;display:-webkit-box;display:-ms-flexbox;display:flex;-ms-flex-direction:column;flex-direction:column}.CTA__Heading{color:#fff;font-family:emsisoft;font-size:38px;line-height:1;margin:0 0 35px;padding:0}.CTA__Description{-webkit-box-flex:1;color:#fff;-ms-flex:1;flex:1;font-family:Arial,sans-serif;font-size:15px!important}.CTA__Button{-ms-flex-negative:0;-ms-flex-item-align:stretch;align-self:stretch;background:-webkit-gradient(linear,left top,left bottom,color-stop(50%,#ff9211),color-stop(50%,#ff8a00));background:linear-gradient(180deg,#ff9211 50%,#ff8a00 0);border:1px solid transparent;border-radius:3px;-webkit-box-shadow:0 0 3px 2px rgba(0,0,0,.1),1px 1px 0 .2px #0375b0,2px 2px 0 .4px #0375b0,3px 3px 0 .6px #0375b0,4px 4px 0 .8px #0375b0,5px 5px 0 1px #0375b0,6px 6px 0 1.2px #0375b0,7px 7px 0 1.4px #0375b0,8px 8px 0 1.6px #0375b0,9px 9px 0 1.8px #0375b0,10px 10px 0 2px #0375b0,11px 11px 0 2.2px #0375b0,12px 12px 0 2.4px #0375b0,13px 13px 0 2.6px #0375b0,14px 14px 0 2.8px #0375b0,15px 15px 0 3px #0375b0,16px 16px 0 3.2px #0375b0,17px 17px 0 3.4px #0375b0,18px 18px 0 3.6p

1x #0375b0,19px 19px 0 3.8px #0375b0,20px 20px 0 4px #0375b0,21px 21px 0 4.2px #0375b0,22px 22px 0 4.4px #0375b0,23px 23px 0 4.6px #0375b0,24px 24px 0 4.8px #0375b0,25px 25px 0 5px #0375b0,26px 26px 0 5.2px #0375b0,27px 27px 0 5.4px #0375b0,28px 28px 0 5.6px #0375b0,29px 29px 0 5.8px #0375b0,30px 30px 0 6px #0375b0,31px 31px 0 6.2px #0375b0,32px 32px 0 6.4px #0375b0,33px 33px 0 6.6px #0375b0,34px 34px 0 6.8px #0375b0,35px 35px 0 7px #0375b0;box-shadow:0 0 3px 2px rgba(0,0,0,.1),1px 1px 0 .2px #0375b0,2px 2px 0 .4px #0375b0,3px 3px 0 .6px #0375b0,4px 4px 0 .8px #0375b0,5px 5px 0 1px #0375b0,6px 6px 0 1.2px #0375b0,7px 7px 0 1.4px #0375b0,8px 8px 0 1.6px #0375b0,9px 9px 0 1.8px #0375b0,10px 10px 0 2px #0375b0,11px 11px 0 2.2px #0375b0,12px 12px 0 2.4px #0375b0,13px 13px 0 2.6px #0375b0,14px 14px 0 2.8px #0375b0,15px 15px 0 3px #0375b0,16px 16px 0 3.2px #0375b0,17px 17px 0 3.4px #0375b0,18px 18px 0 3.6px #0375b0,19px 19px 0 3.8px #0375b0,20px 20px 0 4px #0375b0,21px 21px 0 4.2px #0375b0,22px 22px 0 4.4px #0375b0,23px 23px 0 4.6px #0375b0,24px 24px 0 4.8px #0375b0,25px 25px 0 5px #0375b0,26px 26px 0 5.2px #0375b0,27px 27px 0 5.4px #0375b0,28px 28px 0 5.6px #0375b0,29px 29px 0 5.8px #0375b0,30px 30px 0 6px #0375b0,31px 31px 0 6.2px #0375b0,32px 32px 0 6.4px #0375b0,33px 33px 0 6.6px #0375b0,34px 34px 0 6.8px #0375b0,35px 35px 0 7px #0375b0;color:#fff;flex-shrink:0;font-family:Arial;font-size:16px;font-weight:700;margin-left:0;margin-top:35px;padding:1em;text-align:center;text-transform:uppercase}.CTA__Button:hover{background:-webkit-gradient(linear,left top,left bottom,color-stop(50%,#ff9c28),color-stop(50%,#ff9519));background:linear-gradient(180deg,#ff9c28 50%,#ff9519 0)}.Form select{border:1px solid #0385c6;border-radius:2px;color:#0385c6;outline:0}.Form span>[type=checkbox]:checked,.Form span>[type=checkbox]:not(:checked),.Form span>[type=radio]:checked,.Form span>[type=radio]:not(:checked){display:none;height:0;opacity:0;width:0}.Form span>[type=checkbox]:checked+label,.Form span>[type=checkbox]:not(:checked)+label,.Form span>[type=radio]:checked+label,.Form span>[type=radio]:not(:checked)+label{cursor:pointer;display:inline;margin-bottom:4px;margin-right:4px;margin-top:4px;padding-left:22px;padding-top:2px;position:relative;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}.Form span>[type=checkbox]:checked+label:before,.Form span>[type=checkbox]:not(:checked)+label:before,.Form span>[type=radio]:checked+label:before,.Form span>[type=radio]:not(:checked)+label:before{border:2px solid #0385c6;border-radius:2px;bottom:1px;-webkit-box-sizing:content-box;box-sizing:content-box;color:#0385c6;display:inline-block;height:13px;left:0;line-height:1.3;position:absolute;top:.4em;width:13px}.Form span>[type=checkbox]:checked:focus+label:before,.Form span>[type=checkbox]:not(:checked):focus+label:before,.Form span>[type=radio]:checked:focus+label:before,.Form span>[type=radio]:not(:checked):focus+label:before{border-color:#0385c6;-webkit-box-shadow:0 0 6px 0 #0385c6;box-shadow:0 0 6px 0 #0385c6}.Form span>[type=checkbox]:checked[disabled]+label,.Form span>[type=checkbox]:not(:checked)[disabled]+label,.Form span>[type=radio]:checked[disabled]+label,.Form span>[type=radio]:not(:checked)[disabled]+label{cursor:not-allowed;opacity:.4}.Form span>[type=checkbox]:checked[disabled]+label:before,.Form span>[type=checkbox]:not(:checked)[disabled]+label:before,.Form span>[type=radio]:checked[disabled]+label:before,.Form span>[type=radio]:not(:checked)[disabled]+label:before{opacity:.7}.Form span>[type=checkbox]:checked+label:before,.Form span>[type=checkbox]:not(:checked)+label:before{font-family:fontello;font-size:10px;text-align:center;top:.7em;-webkit-transition:border-color .2s ease-in,background-color .2s ease-in;transition:border-color .2s ease-in,background-color .2s ease-in}.Form span>[type=checkbox]:checked+label:before{background-color:#0385c6;border-color:#0385c6;color:#fff;content:"\e805"}.Form span.has-promo *{opacity:1!important}.Form span.has-promo>[type=checkbox]:checked+label:before{background-color:#f58634;border-color:#f58634}.Form span>[type=checkbox]:not(:checked)+label:before{content:""}.Form span>[type=radio]:checked+label:before,.Form span>[type=radio]:not(:checked)+label:before{border-radius:15px;content:"";-webkit-transition:border-color .2s ease-in,background-color .2s ease-in,-webkit-box-shadow .1s ease-in;transition:border-color .2s ease-in,background-color .2s ease-in,-webkit-box-shadow .1s ease-in;transition:border-color .2s ease-in,box-shadow .1s ease-in,background-color .2s ease-in;transition:border-color .2s ease-in,box-shadow .1s ease-in,background-color .2s ease-in,-webkit-box-shadow .1s ease-in}.Form span>[type=radio]:checked+label:before{background-color:#0385c6;border-color:#0385c6;-webkit-box-shadow:inset 0 0 0 2px #fff;box-shadow:inset 0 0 0 2px #fff;color:#0385c6}.Form span>[type=radio]:not(:checked)+label:before{-webkit-box-shadow:inset 0 0 0 3px #fff;box-shadow:inset 0 0 0 3px #fff}.Form .spinner{border:1px solid #0385c6;border-radius:2px;display:inline-block;padding-right:20px;position:relative}.Form .spinner>input[type=text]{background:none;border:none;color:#0385c6;font-size:18px;outline:none;text-align:center;width:48px}.Form .spinner>input[type=text]:active,.Form .spinner>input[type=text]:focus{border:none;outline:none}.Form .spinner>button,.Form .spinner>button:active,.Form .spinner>button:focus{background:none;border:none;height:50%;outline:none;padding:0;position:absolute;width:20px}.Form input[type=email].has-error,.Form input[type=text].has-error,.Form textarea[required].has-error,.input-wrapper.has-error input[type=email],.input-wrapper.has-error input[type=text],.input-wrapper.has-error textarea[required],.input-wrapper.has-error.input-file label{border-color:#d84315}.input-wrapper.has-error.input-file label:before{border-left-color:#d84315;border-top-color:#d84315}.input-wrapper.input-file{background-color:#fff;margin:0 auto;max-width:220px;position:relative;width:100%;z-index:1}.input-wrapper.input-file label{-webkit-box-pack:justify;-ms-flex-pack:justify;border:1px solid #cdd1d2;border-radius:2px;-webkit-box-sizing:border-box;box-sizing:border-box;

1cursor:pointer;display:-webkit-box;display:-ms-flexbox;display:flex;font-size:16px;justify-content:space-between;min-height:42px;position:relative;-webkit-transition:border-color .15s ease-in-out;transition:border-color .15s ease-in-out;width:100%}.input-wrapper.input-file label:before{background-color:#0385c6;border:1px solid #0385c6;border-radius:2px 0 0 2px;content:"";cursor:pointer;display:block;height:41px;left:-1px;position:absolute;top:-1px;-webkit-transition:background-color .15s ease-in-out,border-color .15s ease-in-out;transition:background-color .15s ease-in-out,border-color .15s ease-in-out;width:41px}.input-wrapper.input-file label:after{background-color:#fff;content:"";cursor:pointer;display:block;height:14px;left:13px;-webkit-mask-image:url(/wp-content/themes/emsisoft_base/dist/images/layout/icons/file.svg);mask-image:url(/wp-content/themes/emsisoft_base/dist/images/layout/icons/file.svg);-webkit-mask-size:contain;mask-size:contain;position:absolute;top:13px;width:14px;z-index:1}.input-wrapper.input-file label:hover:before{background-color:#04a9fb;border-color:#04a9fb}.input-wrapper.input-file .file-name{line-height:40px;margin-left:60px;margin-right:20px;max-width:138px;overflow:hidden;text-align:left;text-overflow:ellipsis;white-space:nowrap;width:100%}.input-wrapper.input-file input[type=file]{height:100%;opacity:0;position:absolute;width:100%}.input-wrapper.input-email,.input-wrapper.input-text{margin:0 auto 6px;max-width:220px}.input-wrapper.input-email input,.input-wrapper.input-email textarea,.input-wrapper.input-text input,.input-wrapper.input-text textarea{border:1px solid #cdd1d2;border-radius:2px;-webkit-box-sizing:border-box;box-sizing:border-box;font-size:16px;height:40px;padding:10px;width:100%}.input-wrapper.input-email:last-child,.input-wrapper.input-text:last-child{margin-bottom:0}.input-wrapper.input-email textarea,.input-wrapper.input-text textarea{height:86px}.input-wrapper.input-email label,.input-wrapper.input-text label{color:#69787d;font-size:16px;margin-bottom:.2em;text-align:center}@media only screen and (max-width:560px){body{padding-top:55px}body.cookieconsent .help-messenger-btn,body.cookieconsent .zsiq_floatmain,body.cookieconsent-open .help-messenger-btn,body.cookieconsent-open .zsiq_floatmain{bottom:100px!important}.button{line-height:1.3;padding:10px 20px;white-space:normal}}@media only screen and (max-width:800px){body.cookieconsent .help-messenger-btn,body.cookieconsent .zsiq_floatmain,body.cookieconsent-open .help-messenger-btn,body.cookieconsent-open .zsiq_floatmain{bottom:90px!important}}@media only screen and (max-width:470px){body.cookieconsent .help-messenger-btn,body.cookieconsent .zsiq_floatmain,body.cookieconsent-open .help-messenger-btn,body.cookieconsent-open .zsiq_floatmain{bottom:140px!important}}@media (max-width:992px){.flex-container{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.flex-container .one-third,.flex-container .two-thirds{-ms-flex-preferred-size:100%;flex-basis:100%}}@media screen and (min-width:980px){#content.is-fluid,.container.is-fluid,main>section>.wp-block-columns.is-fluid,main>section>article>.wp-block-columns.is-fluid{margin:0 20px;max-width:none}}@media screen and (min-width:1180px){#content,.container,main>section>.wp-block-columns,main>section>article>.wp-block-columns{max-width:1320px}}@media (min-width:1200px){.category-nav{background-color:#f4f7f8;border-bottom:1px solid #e3e3e3;display:block;font-size:18px}}@media only screen and (max-width:769px){.mobile-only{display:inherit}.newsletter__title{font-size:26px}}@media only screen and (min-width:769px){.desktop-only{display:inherit}}@media screen and (max-width:769px){.columns,.wp-block-columns{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.grid{grid-template-columns:repeat(1,1fr)!important}.newsletter form{grid-template-columns:auto}.newsletter .emails-opt-wrapper{grid-column-end:2}.button{width:100%}.button-group{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}}@media screen and (max-width:980px){.columns.m-vertical,.wp-block-columns.m-vertical{-webkit-box-orient:vertical;-webkit-box-direction:normal;-ms-flex-direction:column;flex-direction:column}.columns.has-2col .column,.columns.has-2col .wp-block-column,.wp-block-columns.has-2col .column,.wp-block-columns.has-2col .wp-block-column{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;width:100%}.columns.has-2col .column:first-child,.columns.has-2col .wp-block-column:first-child,.wp-block-columns.has-2col .column:first-child,.wp-block-columns.has-2col .wp-block-column:first-child{margin-bottom:15px}.columns.has-3col .column,.columns.has-3col .wp-block-column,.columns.has-4col .column,.columns.has-4col .wp-block-column,.columns.has-half .column,.columns.has-half .wp-block-column,.wp-block-columns.has-3col .column,.wp-block-columns.has-3col .wp-block-column,.wp-block-columns.has-4col .column,.wp-block-columns.has-4col .wp-block-column,.wp-block-columns.has-half .column,.wp-block-columns.has-half .wp-block-column{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;width:100%}.columns.has-half .column.has-pl,.columns.has-half .wp-block-column.has-pl,.wp-block-columns.has-half .column.has-pl,.wp-block-columns.has-half .wp-block-column.has-pl{padding-left:0}.columns .column.one-third,.columns .column.two-third,.columns .wp-block-column.one-third,.columns .wp-block-column.two-third,.wp-block-columns .column.one-third,.wp-block-columns .column.two-third,.wp-block-columns .wp-block-column.one-third,.wp-block-columns .wp-block-column.two-third{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto;width:100%}}@media screen and (min-width:769px) and (max-width:1180px){.grid{grid-template-columns:repeat(2,1fr)!important}}@media only screen and (max-width:782px){body.admin-bar .header{position:absolute;top:46px}}

1@media (min-width:768px){.header .cta{display:block}}@media only screen and (max-width:1199px){.header .nav ul.menu>li:hover{display:block;width:100%}.header .nav ul.menu>li.menu-item-has-children>a:after,.header .nav ul.menu>li.menu-item-has-children>a:before{background-color:#58676b;height:2px;right:30.5px;width:14px}.header .nav ul.menu>li.menu-item-has-children>a:after{right:39.5px}.header .nav ul.menu>li.menu-item-has-children>a:hover:after,.header .nav ul.menu>li.menu-item-has-children>a:hover:before{background-color:#58676b}.header .nav ul.menu>li>ul{border:0;border-radius:0}.header>.container{-webkit-box-pack:justify;-ms-flex-pack:justify;-webkit-box-align:center;-ms-flex-align:center;align-items:center;display:-webkit-box;display:-ms-flexbox;display:flex;justify-content:space-between;max-width:100%;padding:0}.header>.container .wrapper{padding:0 15px}.header .cta,.header .nav-about{display:none}.nav-is-active .header .nav{-webkit-transform:translate(-15px);-ms-transform:translate(-15px);transform:translate(-15px);-webkit-transition-delay:0s;transition-delay:0s}.nav-is-active .header .nav:before{background-color:hsla(192,6%,66%,.5)}.nav-is-active .header .nav>div{-webkit-transform:translate(0);-ms-transform:translate(0);transform:translate(0)}.nav-is-active .header .nav ul.menu>li.opened>a:before{-webkit-transform:rotate(45deg);-ms-transform:rotate(45deg);transform:rotate(45deg)}.nav-is-active .header .nav ul.menu>li.opened>a:after{-webkit-transform:rotate(-45deg);-ms-transform:rotate(-45deg);transform:rotate(-45deg)}.nav-is-active .header .nav ul.menu>li.opened>ul{height:auto;opacity:1;visibility:visible}.nav-is-active .header .nav ul.menu>li ul{-webkit-box-shadow:none;box-shadow:none;display:block;height:0;opacity:0;overflow:hidden;position:relative;-webkit-transition:all .5s cubic-bezier(0,1,.5,1);transition:all .5s cubic-bezier(0,1,.5,1);visibility:hidden}.nav-is-active .header .nav ul.menu>li ul li{background-color:#fff;border-color:transparent;-webkit-box-shadow:none;box-shadow:none;height:auto;margin-left:0}.nav-is-active .header .nav ul.menu>li ul li a{height:auto;line-height:50px;padding:0 0 0 45px}.nav-is-active .header .nav ul.menu>li ul li:active,.nav-is-active .header .nav ul.menu>li ul li:hover{background-color:#f2f2f2}.nav-is-active .header .nav ul.menu>li:hover>a.nav-item{background-color:transparent;border-color:transparent;border-radius:0;-webkit-box-shadow:none;box-shadow:none}.nav-is-active .header .nav ul.menu:nth-child(2) ul.menu{margin-bottom:2px}.nav-is-active .header .nav .search__rollin{width:100%}.nav-is-active .nav ul>li:hover>ul{height:0;opacity:0;visibility:hidden}.search-active .nav ul.menu{opacity:1}.search-active .nav ul.menu:before{display:none;height:0;width:0;z-index:0}}@media screen and (min-width:901px){.d-mr1{margin-right:1em}.d-pr1{padding-right:1em}.d-pl1{padding-left:1em}.d-text-left{text-align:left}}@media screen and (max-width:900px){.m-mb1{margin-bottom:1em}.m-mb2{margin-bottom:2em}.m-w100{width:100%}}@media only screen and (max-width:980px){.button-group .button-wrapper{margin:5px 0;width:100%}.button-group.is-half{width:100%}.button-group.is-original .button{-webkit-box-flex:1;-ms-flex:1 1 auto;flex:1 1 auto}.button-group.has-large .button-wrapper{margin:4px 0}.button-group .button-wrapper{margin-bottom:25px}}@media only screen and (max-width:1200px){.button-group .button-wrapper p{position:static}}@media (min-width:992px){.CTA__Body{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-ms-flex-direction:row;flex-direction:row}.CTA__Button{-ms-flex-item-align:end;align-self:flex-end;margin-left:35px;margin-top:0}} </style> <meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' /> <meta name="description" content="How ransomware operators avoid your security solutions and what you can do to protect your network against post-compromise ransomware attacks." /> <link rel="canonical" href="https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/" /> <meta property="og:locale" content="en_US" /> <meta property="og:locale:alternate" content="de_DE" /> <meta property="og:type" content="article" /> <meta property="og:title" content="How ransomware attackers evade your organizationâs security" /> <meta property="og:description" content="How ransomware operators avoid your security solutions and what you can do to protect your network against post-compromise ransomware attacks." /> <meta property="og:url" content="https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/" /> <meta property="og:site_name" content="Emsisoft | Cybersecurity Blog" /> <meta property="article:publisher" content="https://www.facebook.com/Emsisoft/" /> <meta property="article:published_time" content="2020-08-19T13:45:53+00:00" /> <meta property="article:modified_time" content="2023-12-01T19:58:05+00:00" /> <meta property="og:image" content="https://www.emsisoft.com/en/blog/wp-content/uploads/2020/08/How-ransomware-attackers-evade-your-organizations-security-solutions-fb.png" /> <meta property="og:image:width" content="860" /> <meta property="og:image:height" content="450" /> <meta property="og:image:type" content="image/png" /><meta property="og:image" content="https://blog.emsisoft.com/wp-content/uploads/2020/08/How-ransomware-attackers-evade-your-organizations-security-solutions.png" /> <meta property="og:image:width" content="730" /> <meta property="og:image:height" content="411" /> <meta property="og:image:type" content="image/png" /> <meta name="author" content="Jareth" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:creator" content="@emsisoft" /> <meta name="twitter:site" content="@emsisoft" />

1<script type="application/ld+json" class="yoast-schema-graph">{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/#article","isPartOf":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/"},"author":{"name":"Jareth","@id":"https:\/\/www.emsisoft.com\/en\/blog\/#\/schema\/person\/a4bdf32cc393a7881ca4a3818835f6e2"},"headline":"How ransomware attackers evade your organizationâs security solutions","datePublished":"2020-08-19T13:45:53+00:00","dateModified":"2023-12-01T19:58:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/"},"wordCount":1139,"image":"https:\/\/www.emsisoft.com\/en\/blog\/#logo","thumbnailUrl":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/uploads\/2020\/08\/How-ransomware-attackers-evade-your-organizations-security-solutions.png","articleSection":["Ransomware"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/","url":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/","name":"How ransomware attackers evade your organizationâs security","isPartOf":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/#primaryimage"},"image":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/#primaryimage"},"thumbnailUrl":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/uploads\/2020\/08\/How-ransomware-attackers-evade-your-organizations-security-solutions.png","datePublished":"2020-08-19T13:45:53+00:00","dateModified":"2023-12-01T19:58:05+00:00","author":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/#\/schema\/person\/a4bdf32cc393a7881ca4a3818835f6e2"},"description":"How ransomware operators avoid your security solutions and what you can do to protect your network against post-compromise ransomware attacks.","breadcrumb":{"@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/#primaryimage","url":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/uploads\/2020\/08\/How-ransomware-attackers-evade-your-organizations-security-solutions.png","contentUrl":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/uploads\/2020\/08\/How-ransomware-attackers-evade-your-organizations-security-solutions.png","width":730,"height":411,"caption":"How ransomware attackers evade your organizationâs security solutions"},{"@type":"BreadcrumbList","@id":"https:\/\/www.emsisoft.com\/en\/blog\/36786\/how-ransomware-attackers-evade-your-organizations-security-solutions\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Emsisoft","item":"https:\/\/www.emsisoft.com\/en\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/www.emsisoft.com\/en\/blog\/"},{"@type":"ListItem","position":3,"name":"Blog","item":"https:\/\/www.emsisoft.com\/en\/blog\/"},{"@type":"ListItem","position":4,"name":"Malware Lab","item":"https:\/\/www.emsisoft.com\/en\/blog\/category\/malware-lab\/"},{"@type":"ListItem","position":5,"name":"Ransomware","item":"https:\/\/www.emsisoft.com\/en\/blog\/category\/malware-lab\/ransomware\/"},{"@type":"ListItem","position":6,"name":"How ransomware attackers evade your organizationâs security solutions"}]},{"@type":"WebSite","@id":"https:\/\/www.emsisoft.com\/en\/blog\/#website","url":"https:\/\/www.emsisoft.com\/en\/blog\/","

1name":"Emsisoft | Cybersecurity Blog","description":"Straight-talking security advice from the Malware Experts","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.emsisoft.com\/en\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.emsisoft.com\/en\/blog\/#\/schema\/person\/a4bdf32cc393a7881ca4a3818835f6e2","name":"Jareth","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/002688381df998478e0df99c495dee9c14e5a7a740207ccd56e786268530fcd0?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/002688381df998478e0df99c495dee9c14e5a7a740207ccd56e786268530fcd0?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/002688381df998478e0df99c495dee9c14e5a7a740207ccd56e786268530fcd0?s=96&d=mm&r=g","caption":"Jareth"},"description":"Writer. A picture is worth a thousand words but unfortunately I can't draw. The world of IT security has always fascinated me and I love playing a small role in helping the good guys combat malware.","url":"https:\/\/www.emsisoft.com\/en\/blog\/author\/jareth\/"}]}</script>

1 <title>How ransomware attackers evade your organizationâs security</title> <link rel="alternate" href="https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/" hreflang="en" /> <link rel="alternate" href="https://www.emsisoft.com/de/blog/36818/so-umgehen-ransomware-angreifer-die-sicherheitsloesungen-ihres-unternehmens/" hreflang="de" /> <link rel='dns-prefetch' href='//cdn-cookieyes.com' /> <link rel='dns-prefetch' href='//www.emsisoft.com' /> <link rel="alternate" type="application/rss+xml" title="Emsisoft | Cybersecurity Blog &raquo; Feed" href="https://www.emsisoft.com/en/blog/feed/" /> <link rel="alternate" type="application/rss+xml" title="Emsisoft | Cybersecurity Blog &raquo; Comments Feed" href="https://www.emsisoft.com/en/blog/comments/feed/" /> <link rel="alternate" title="oEmbed (JSON)" type="application/json+oembed" href="https://www.emsisoft.com/en/blog/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.emsisoft.com%2Fen%2Fblog%2F36786%2Fhow-ransomware-attackers-evade-your-organizations-security-solutions%2F&#038;lang=en" /> <link rel="alternate" title="oEmbed (XML)" type="text/xml+oembed" href="https://www.emsisoft.com/en/blog/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.emsisoft.com%2Fen%2Fblog%2F36786%2Fhow-ransomware-attackers-evade-your-organizations-security-solutions%2F&#038;format=xml&#038;lang=en" /> <style id="wp-img-auto-sizes-contain-inline-css"> img:is([sizes=auto i],[sizes^="auto," i]){contain-intrinsic-size:3000px 1500px} /*# sourceURL=wp-img-auto-sizes-contain-inline-css */ </style> <style id="global-styles-inline-css"> :root{--wp--preset--aspect-ratio--square: 1;--wp--preset--aspect-ratio--4-3: 4/3;--wp--preset--aspect-ratio--3-4: 3/4;--wp--preset--aspect-ratio--3-2: 3/2;--wp--preset--aspect-ratio--2-3: 2/3;--wp--preset--aspect-ratio--16-9: 16/9;--wp--preset--aspect-ratio--9-16: 9/16;--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgb(6,147,227) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgb(252,185,0) 0%,rgb(255,105,0) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgb(255,105,0) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);

1--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgb(255, 255, 255), 6px 6px rgb(0, 0, 0);--wp--preset--shadow--crisp: 6px 6px 0px rgb(0, 0, 0);}.wp-block-button{--wp--preset--dimension--25: 25%;--wp--preset--dimension--50: 50%;--wp--preset--dimension--75: 75%;--wp--preset--dimension--100: 100%;}:where(body) { margin: 0; }:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout-grid{display: grid;}.is-layout-grid > :is(*, div){margin: 0;}body{padding-top: 0px;padding-right: 0px;padding-bottom: 0px;padding-left: 0px;}:root :where(.wp-element-button, .wp-block-button__link){background-color: #32373c;border-width: 0;color: #fff;font-family: inherit;font-size: inherit;font-style: inherit;font-weight: inherit;letter-spacing: inherit;line-height: inherit;padding-top: calc(0.667em + 2px);padding-right: calc(1.333em + 2px);padding-bottom: calc(0.667em + 2px);padding-left: calc(1.333em + 2px);text-decoration: none;text-transform: inherit;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}

1.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;} /*# sourceURL=global-styles-inline-css */ </style> <link rel='stylesheet' id='emsisoft-base-mfp-styles-css' href='https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/css/mfp.css?id=413a6561412e1989eb1e0c9bdf0c47a4' media='print' /> <link rel='stylesheet' id='emsisoft-base-blog-styles-css' href='https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/css/blog.css?id=31af525bc30f91b249d64a7abce46979&#038;ver=974ca3327cec34fa9fd0422d9d5f7b63' media='all' /> <link rel='stylesheet' id='emsisoft-blog-styles-css' href='https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_blog/dist/css/app.css?id=3b27e47763cac2afed1c73843fe52910&#038;ver=974ca3327cec34fa9fd0422d9d5f7b63' media='all' />

1<script id="cookieyes-js" src="https://cdn-cookieyes.com/client_data/e404e190ed87ada861cf560a/script.js"></script>

1 <link rel="https://api.w.org/" href="https://www.emsisoft.com/en/blog/wp-json/" /><link rel="alternate" title="JSON" type="application/json" href="https://www.emsisoft.com/en/blog/wp-json/wp/v2/posts/36786" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.emsisoft.com/en/blog/xmlrpc.php?rsd" /> <link rel='shortlink' href='https://www.emsisoft.com/en/blog/?p=36786' />

1<script type="text/javascript"> (function(url){ if(/(?:Chrome\/26\.0\.1410\.63 Safari\/537\.31|WordfenceTestMonBot)/.test(navigator.userAgent)){ return; } var addEvent = function(evt, handler) { if (window.addEventListener) { document.addEventListener(evt, handler, false); } else if (window.attachEvent) { document.attachEvent('on' + evt, handler); } }; var removeEvent = function(evt, handler) { if (window.removeEventListener) { document.removeEventListener(evt, handler, false); } else if (window.detachEvent) { document.detachEvent('on' + evt, handler); } }; var evts = 'contextmenu dblclick drag dragend dragenter dragleave dragover dragstart drop keydown keypress keyup mousedown mousemove mouseout mouseover mouseup mousewheel scroll'.split(' '); var logHuman = function() { if (window.wfLogHumanRan) { return; } window.wfLogHumanRan = true; var wfscr = document.createElement('script'); wfscr.type = 'text/javascript'; wfscr.async = true; wfscr.src = url + '&r=' + Math.random(); (document.getElementsByTagName('head')[0]||document.getElementsByTagName('body')[0]).appendChild(wfscr); for (var i = 0; i < evts.length; i++) { removeEvent(evts[i], logHuman); } }; for (var i = 0; i < evts.length; i++) { addEvent(evts[i], logHuman); } })('//www.emsisoft.com/en/blog/?wordfence_lh=1&hid=CEA838E28430E37448211FDB12716E0E'); </script>

1<link rel="amphtml" href="https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/amp/"><link rel="icon" href="https://www.emsisoft.com/en/blog/wp-content/uploads/2023/12/cropped-icon_eam-32x32.png" sizes="32x32" /> <link rel="icon" href="https://www.emsisoft.com/en/blog/wp-content/uploads/2023/12/cropped-icon_eam-192x192.png" sizes="192x192" /> <link rel="apple-touch-icon" href="https://www.emsisoft.com/en/blog/wp-content/uploads/2023/12/cropped-icon_eam-180x180.png" /> <meta name="msapplication-TileImage" content="https://www.emsisoft.com/en/blog/wp-content/uploads/2023/12/cropped-icon_eam-270x270.png" /> <link rel='stylesheet' id='emsisoft-base-footer-styles-css' href='https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/css/footer.css?id=524d292cf0037b5cf5bddfc1f4956403' onload="this.media='screen'" media='print' /> <link rel='stylesheet' id='emsisoft-base-newsletter-footer-styles-css' href='https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/css/newsletter-footer.css?id=88e7786f56ab2a00125e6bac6e0a840a' media='all' /> </head> <body class="wp-singular post-template-default single single-post postid-36786 single-format-standard wp-theme-emsisoft_base wp-child-theme-emsisoft_blog">

vendor: 68 bytes, line 1

1 <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=

1GTM-WK8DP7

vendor: 83 bytes, line 1

1" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>

1<header class="header"> <div class="container"> <div class="wrapper"> <div class="logo"> <a class="logo-emsisoft" href="https://www.emsisoft.com/en/" aria-label="Emsisoft graphic logo"> <img src="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/layout/logo.svg?id=c0f87631c419e4c180b87dfa3151a3c3" alt="Emsisoft" width="138" height="30"> Emsisoft </a><a class="logo-sub" href="https://www.emsisoft.com/en/blog/"> <img src="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_blog/dist/images/logo_blog_blue.svg?id=fcc6cfb72907eace5bf4beb2df122b95" alt="Emsisoft Blog" width="46" height="29"> </a></div> <nav class="nav"> <div class="search__wrapper"> <div class="search__bar"> <label class="search__rollin"> <span class="screen-reader-text">Search for:</span> <span class="search__icon"> <svg role="img" aria-hidden="true" width="20" height="20"><use xlink:href="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a970958e9f909#icon-search"></use></svg> </span> <input data-url="https://www.emsisoft.com/en/blog/post-ajax.php?action=top_search" data-search-type="blog-top" type="search" placeholder="Search Blog &hellip;" autocomplete="off" data-searchurl="https://www.emsisoft.com/en/blog/search/term/"/> </label> <div class="search__results"></div> <span class="search__icon is-button"> <svg class="search__on-closed" role="img" aria-hidden="true" width="20" height="20"><use xlink:href="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a970958e9f909#icon-search"></use></svg> <span class="search__on-opened icon-close"></span> </span> </div> </div> <div class="menu-header_en-container"><ul id="menu-header_en" class="menu"><li id="menu-item-37518" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-37518"><a href="https://www.emsisoft.com/en/why-emsisoft/">Why Emsisoft</a></li> <li id="menu-item-28599" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-28599"><a href="https://www.emsisoft.com/en/protection/">Protection</a> <ul class="sub-menu"> <li id="menu-item-43888" class="mobile-only menu-item menu-item-type-custom menu-item-object-custom menu-item-43888"><a href="https://www.emsisoft.com/en/protection/">Compare editions</a></li> <li id="menu-item-32820" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-32820"><a href="https://www.emsisoft.com/en/business-security/">Business Security</a></li> <li id="menu-item-28604" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-28604"><a href="https://www.emsisoft.com/en/enterprise-security/">Enterprise Security + EDR</a></li> <li id="menu-item-32819" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-32819"><a href="https://www.emsisoft.com/en/managed-service-providers/">MSP Security</a></li> <li id="menu-item-28600" class="border-top menu-item menu-item-type-custom menu-item-object-custom menu-item-28600"><a href="https://www.emsisoft.com/en/anti-malware-home/">Anti-Malware Home</a></li> <li id="menu-item-43889" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-43889"><a href="https://www.emsisoft.com/en/mobile-security/">Mobile Security</a></li> </ul> </li> <li id="menu-item-33490" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-33490"><a href="https://www.emsisoft.com/en/remediation-kit/">Remediation</a> <ul class="sub-menu"> <li id="menu-item-33492" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-33492"><a href="https://www.emsisoft.com/en/remediation-kit/">Remediation Kit</a></li> <li id="menu-item-33493" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-33493"><a href="https://www.emsisoft.com/en/commandline-scanner/">Commandline Scanner</a></li> <li id="menu-item-33491" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-33491"><a href="https://www.emsisoft.com/en/ransomware-decryption/">Ransomware Decryption</a></li> </ul> </li> <li id="menu-item-37519" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-37519"><a href="https://www.emsisoft.com/en/partners/">Partners</a> <ul class="sub-menu"> <li id="menu-item-43890" class="mobile-only menu-item menu-item-type-custom menu-item-object-custom menu-item-43890"><a href="https://www.emsisoft.com/en/partners/">Partners</a></li> <li id="menu-item-41445" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41445"><a href="https://www.emsisoft.com/en/managed-service-providers/">Managed Service Providers</a></li> <li id="menu-item-41446" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41446"><a href="https://www.emsisoft.com/en/third-party-integrations/">Third Party Integrations</a></li> <li id="menu-item-41447" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41447"><a href="https://www.emsisoft.com/en/security-operations-centers

1/">Security Operations Centers</a></li> <li id="menu-item-41448" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41448"><a href="https://www.emsisoft.com/en/resellers/">Resellers</a></li> <li id="menu-item-41449" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41449"><a href="https://www.emsisoft.com/en/affiliates/">Affiliates</a></li> </ul> </li> <li id="menu-item-28609" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-28609"><a href="https://www.emsisoft.com/en/pricing/">Pricing</a> <ul class="sub-menu"> <li id="menu-item-28610" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-28610"><a href="https://www.emsisoft.com/en/pricing/">Buy online</a></li> <li id="menu-item-28613" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-28613"><a href="https://www.emsisoft.com/en/buy-local/">Buy from local partner</a></li> <li id="menu-item-28612" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-28612"><a href="https://www.emsisoft.com/en/renew/">Renew license</a></li> </ul> </li> </ul></div></nav> <button class="hamburger hamburger--collapse" type="button" aria-label="Main menu"> <span class="hamburger-box"> <span class="hamburger-inner"></span> </span> </button> </div> <div class="menu-sub-about"> <div class="search__wrapper"> <div class="search__bar"> <label class="search__rollin"> <span class="screen-reader-text">Search for:</span> <span class="search__icon"> <svg role="img" aria-hidden="true" width="20" height="20"><use xlink:href="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a970958e9f909#icon-search"></use></svg> </span> <input data-url="https://www.emsisoft.com/en/blog/post-ajax.php?action=top_search" data-search-type="blog-top" type="search" placeholder="Search Blog &hellip;" autocomplete="off" data-searchurl="https://www.emsisoft.com/en/blog/search/term/"/> </label> <div class="search__results"></div> <span class="search__icon is-button"> <svg class="search__on-closed" role="img" aria-hidden="true" width="20" height="20"><use xlink:href="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/icons.svg?id=44716d8c791ad9a5672a970958e9f909#icon-search"></use></svg> <span class="search__on-opened icon-close"></span> </span> </div> </div> <div class="login"> <iframe src="https://my.emsisoft.com/auth-state.html?lang=en" frameborder="0" title="MyEmsisoft Login"></iframe> </div> </div> </div> </header> <article id="post-36786" class="post"> <header class="post__header main-banner" style="background-color:#617175;color:#ffffff;"> <div class="container"> <ul class="post__header__menu has-categories"> <li><a href="https://www.emsisoft.com/en/blog/category/malware-lab/ransomware/">Ransomware</a></li> </ul> <h1 class="post__title">How ransomware attackers evade your organizationâs security solutions</h1> <ul class="post__header__menu"> <li> <a href="https://www.emsisoft.com/en/blog/author/jareth/" title="Posts by Jareth" rel="author"> Jareth </a></li> <li><span title="Published at">August 19, 2020</span></li> <li>5 min read</li> </ul> <img width="568" height="319" src="https://www.emsisoft.com/en/blog/wp-content/uploads/2020/08/How-ransomware-attackers-evade-your-organizations-security-solutions-568x319.png.webp" class="attachment-medium size-medium wp-post-image" alt="How ransomware attackers evade your organizationâs security solutions" title="How ransomware attackers evade your organizationâs security solutions" decoding="async" fetchpriority="high" srcset="https://www.emsisoft.com/en/blog/wp-content/uploads/2020/08/How-ransomware-attackers-evade-your-organizations-security-solutions-568x319.png.webp 568w, https://www.emsisoft.com/en/blog/wp-content/uploads/2020/08/How-ransomware-attackers-evade-your-organizations-security-solutions-300x169.png.webp 300w, https://www.emsisoft.com/en/blog/wp-content/uploads/2020/08/How-ransomware-attackers-evade-your-organizations-security-solutions.png.webp 730w" sizes="(max-width: 568px) 100vw, 568px" /> </div> </header> <nav class="category-nav"><div class="container"><div class="menu-category_en-container"><ul id="menu-category_en" class="menu"><li id="menu-item-1" class="menu-item-1"><a href="https://www.emsisoft.com/en/blog/">Most Recent</a></li> <li id="menu-item-30049" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-30049"><a href="https://www.emsisoft.com/en/blog/category/latest-videos/">Latest Videos</a></li> <li id="menu-item-28557" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-28557"><a href="https://www.emsisoft.com/en/blog/category/protection-guides/">Protection Guides</a></li> <li id="menu-item-30051" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor menu-item-30051"><a href="https://www.emsisoft.com/en/blog/category/malware-lab/">Malware Lab</a></li> <li id="menu-item-28470" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-28470"><a href="https://www.emsisoft.com/en/blog/category/emsisoft-news/">Emsisoft News</a></li> <li id="menu-item-28558" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-28558"><a href="https://www.emsisoft.com/en/blog/category/enterprise-security/">Enterprise Security</a></li> </ul></div></div></nav> <main class="post__content container is-slim"><p>&nbsp;</p> <p>You might be surprised to learn that just about every reputable antivirus product on the market can reliably stop the majority of ransomware families. In fact, most ransomware authors donât even try to hide their ransomware through obfuscation or packing, which makes detection fairly straightforward for good antivirus solutions.</p> <p>Why then are so many organizations still falling to ransomware? The issue isnât so much about the capabilities of your antivirus software, nor is it really about ransomware &#8211; itâs about what attackers can do after compromising your network.</p> <p>In this blog post, weâre going to show you exactly how ransomware attackers evade your security solutions, what happens during a post-compromise attack and what you can do to secure your network.</p> <h2>The shift to post-compromise deployment</h2> <p>Historically, ransomware groups have taken a shotgun approach to attacks. They used spam campaigns, hacked websites and exploit kits to indiscriminately deliver ransomware to as many targets as possible and demanded a relatively modest three-digit ransom to decrypt files. It was a quantity over quality game, and attackers didnât spend much time, if any, investigating victimsâ networks before deploying their ransomware.</p> <p>However, this has changed dramatically over the last couple of years as threat actors shifted toward more selective and sophisticated post-compromise attacks. While distribution methods have largely remained the same (along with the notable rise in <a href="https://www.emsisoft.com/en/blog/36601/how-to-secure-rdp-from-ransomware-attackers/" target="_blank" rel="noopener noreferrer">RDP-based attacks</a>) malicious actors now spend more time gathering information about the target network before deploying ransomware payloads. The median malware dwell time, defined as the length of time between compromise and detection, is 56 days, according to a <a href="https://content.fireeye.com/m-trends/rpt-m-trends-2020" target="_blank" rel="noopener noreferrer">report</a> by threat intelligence firm FireEye.</p> <p>Careful reconnaissance allows threat actors to maximize the impact of an attack and the corresponding ransom amount. But what exactly are attackers doing during these 56 days?</p> <ul> <li>Studying the compromised network to get a better understanding of which servers and workstations to hit to maximize impact.</li> <li>Installing malware that allows attackers to communicate with and control infected machines.</li> <li>Harvesting credentials and escalating privileges in order to move laterally to other machines on the network.</li> <li>Exfiltrating corporate data, which can be used to extort victims or sold on the black market.</li> <li>Figuring out which backup mechanisms are in place and how to ensure the backups are destroyed during the attack.</li> </ul> <p>Importantly, post-compromise attacks also allow threat actors to assess a targetâs security systems and disable security processes before the ransomware payload is delivered. After obtaining high-level privileges, attackers can disable security processes via the security productâs centralized dashboard or simply whitelist ransomware executables, ensuring the final ransomware payload escapes detection.</p> <h2>The most common attack vectors for ransomware</h2> <p>Ransomware is a symptom of a larger, systemic issue, and should be viewed as what it really is: a currently popular way to monetize compromised networks, just as cryptojacking, password stealing and financial fraud once were.</p> <p>With this in mind, organizations should focus on detecting and blocking the initial point of compromise rather than

1investing in ransomware-specific protection. Organizations should pay particular attention to the biggest ransomware attack vectors, which include:</p> <ul> <li><strong>Weak credentials</strong>: Weak login credentials are responsible for many ransomware incidents. Threat actors typically use brute-force tools to hack poorly protected remote desktop protocol (RDP) connections and gain access to an organizationâs internal network.</li> <li><strong>Vulnerabilities</strong>: Attackers frequently take advantage of known software vulnerabilities to gain unauthorized access to the network. Software that facilitates remote access carries a particularly high level of risk.</li> <li><strong>Human error</strong>: Threat actors commonly use social engineering methods such as spear phishing to gain access to corporate networks. These types of attacks typically aim to trick the user into opening a malicious macro-embedded attachment, which deploys malware that allows attackers to pivot to other parts of the network after the initial infection.</li> </ul> <h2>Protecting against post-compromise ransomware attacks</h2> <p>Organizations shouldnât rely exclusively on specialized ransomware protection products because, as weâve learned, ransomware isnât the core problem. Instead, organizations should focus on preventing the initial point of infection, using proven cybersecurity practices to minimize the risk of compromise.</p> <p>Below is a non-comprehensive list of cybersecurity best practices that can help protect the network against compromise and, by extension, post-compromise ransomware attacks.</p> <ul> <li><strong>Multi-factor authentication (MFA)</strong>: MFA requires users to provide more than one form of authentication to prove their identity, making it one of the most effective ways of combating compromised credentials. MFA should ideally be implemented wherever possible, with particular attention given to administrator accounts, Internet-facing systems and valuable data repositories. Access to antivirus software settings should also be secured with MFA, which can be easily implemented in cloud-based antivirus management platforms such as <a href="https://www.emsisoft.com/en/management-console/" target="_blank" rel="noopener noreferrer">Emsisoft Management Console</a>.</li> <li><strong>Credential hygiene</strong>: To reduce the risk of compromised credentials, organizations must practice good credential hygiene. Passwords used throughout the network should be long, unique and random. Organizations should also have systems in place to detect and challenge risky logins, such as login attempts coming from new locations, unfamiliar devices or TOR browsers.</li> <li><strong>Patch management</strong>: Threat actors frequently take advantage of vulnerable software to remotely execute malicious code or escalate privileges after compromising a network. All organizations should have an effective patch management strategy in place that ensures security updates are applied quickly (ideally within the first week of the patch release).</li> <li><strong>System hardening</strong>: System hardening is useful for reducing a systemâs attack surface and managing potential security vulnerabilities. Depending on the needs of the organization, it may be possible to lock down or remove superfluous and potentially exploitable services, such as PowerShell, RDP, Windows Script Host, Microsoft Office macros, etc.</li> <li><strong>Endpoint malware protection</strong>: As noted earlier, most reputable endpoint antivirus solutions can reliably detect and stop most ransomware families. Malware protection software should be installed and regularly updated on all endpoints in an organization.</li> <li><strong>Principle of least privilege</strong>: The principle of least privilege stipulates that every user should have only the access privileges required to perform their job. Implementing this principle across the network can make lateral movement more difficult and prevent attackers from gaining access to critical systems or data after compromising a userâs account or device.</li> <li><strong>Network segmentation</strong>: Network segmentation allows for better security and access control, and can help prevent unauthorized users from accessing specific network resources. Should the perimeter be breached, good network segmentation can also stop malware propagating across the network and prevent attackers from easily pivoting from one system to another.</li> </ul> <h2>Conclusion</h2> <p>Modern ransomware is typically deployed post-compromise, which allows threat actors to learn more about the target system, steal sensitive data, disable security processes and ultimately maximize the impact of an attack.</p> <p>Reducing the risk of compromise also reduces the risk of ransomware. Thus, the most efficient and cost-effective way to mitigate ransomware attacks is to investigate and address potential network vulnerabilities rather than

1investing in ransomware-specific protection.</p><div class="accent-block-wrapper" data-accent-id="emsisoft-enterprise-security-edr" data-accent-index="14"><div class="post__content-accent-block type-ees-edr is-inverted"> <div class="post__content-accent-block-content"> <h3>Emsisoft Enterprise Security + EDR</h3> Robust and proven endpoint security solution for organizations of all sizes. <a class="is-orange" href="https://www.emsisoft.com/en/business-security/#enterprise-security">Start free trial</a> </div> </div></div> <p>&nbsp;</p> </main> <section class="authorbox container is-slim"> <img alt='Jareth' src='https://secure.gravatar.com/avatar/002688381df998478e0df99c495dee9c14e5a7a740207ccd56e786268530fcd0?s=127&#038;d=mm&#038;r=g' srcset='https://secure.gravatar.com/avatar/002688381df998478e0df99c495dee9c14e5a7a740207ccd56e786268530fcd0?s=254&#038;d=mm&#038;r=g 2x' class='avatar avatar-127 photo authorbox__image' height='127' width='127' decoding='async'/> <div class="authorbox__body"> <h3 class="authorbox__name"> <a href="https://www.emsisoft.com/en/blog/author/jareth/"> Jareth </a> <ul class="authorbox__links"> </ul> </h3> <p class="authorbox__description"> Writer. A picture is worth a thousand words but unfortunately I can't draw. The world of IT security has always fascinated me and I love playing a small role in helping the good guys combat malware. </p> </div> <ul class="authorbox__links"> </ul> </section> </article> <div class="container"> <nav class="shareBar" data-token="d2141a4f5f" data-post-id="36786"> <ul> <li class="shareBar__header">Share</li> <li> <button class="shareBar__icon icon-facebook" onClick="socialShare('https://www.facebook.com/sharer.php?u=https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/')"></button> </li> <li> <button class="shareBar__icon icon-twitter" onClick="socialShare('https://twitter.com/intent/tweet?text=âHow%20ransomware%20attackers%20evade%20your%20organization%E2%80%99s%20security%20solutionsâ by @emsisoft https://www.emsisoft.com/en/blog/?p=36786')"></button> </li> <li> <button class="shareBar__icon icon-linkedin" onClick="socialShare('https://www.linkedin.com/shareArticle?url=https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/&title=')"></button> </li> <li> <button class="shareBar__icon icon-reddit" onClick="socialShare('https://reddit.com/submit?url=https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/&title=How%20ransomware%20attackers%20evade%20your%20organization%E2%80%99s%20security%20solutions')"></button> </li> </ul> </nav> </div> <section id="related-posts" class="container post__section"> <h2>What to read next</h2> <ul class="has-cards md"> <article class="card post-46626"> <time datetime="2025-04-17T15:10:04+02:00">Apr 17, 2025</time> <a href="https://www.emsisoft.com/en/blog/46626/the-state-of-ransomware-in-q1-2025/" title="Read more..." class="card__image"> <img width="568" height="319" src="https://www.emsisoft.com/en/blog/wp-content/uploads/2025/04/Copy-of-Untitled-Design-9-568x319.png.webp" class="attachment-medium size-medium wp-post-image" alt="The State of Ransomware in Q1 2025" title="The State of Ransomware in Q1 2025" decoding="async" srcset="https://www.emsisoft.com/en/blog/wp-content/uploads/2025/04/Copy-of-Untitled-Design-9-568x319.png.webp 568w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/04/Copy-of-Untitled-Design-9-730x411.png.webp 730w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/04/Copy-of-Untitled-Design-9-300x169.png.webp 300w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/04/Copy-of-Untitled-Design-9-768x432.png.webp 768w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/04/Copy-of-Untitled-Design-9.png.webp 1280w" sizes="(max-width: 568px) 100vw, 568px" /> <div class="card__time">5 min read</div> </a> <div class="card__content"> <ul class="card__menu"> <li class="time-item">Apr 17, 2025</li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/commentaries/">Commentaries</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/malware-lab/ransomware/">Ransomware</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/spotlight-ransomware/">Spotlight on Ransomware</a></li> </ul> <a href="https://www.emsisoft.com/en/blog/46626/the-state-of-ransomware-in-q1-2025/" title="Read more..."> <h3 class="card__title">The State of Ransomware in Q1 2025</h3> <p class="card__excerpt">This article provides an in-depth look at ransomware activity in Q1 2025, highlighting attack trends, the most active threat groups, global impact, and the challenges of accurately tracking cybercrime.</p> </a> </div> </article> <article class="card post-46288"> <time datetime="2025-01-09T16:04:01+01:00">Jan 9, 2025</time> <a href="https://www.emsisoft.com/en/blog/46288/the-state-of-ransomware-in-the-u-s-report-and-statistics-2024/" title="Read more..." class="card__image"> <img width="568" height="319" src="https://www.emsisoft.com/en/blog/wp-content/uploads/2025/01/Copy-of-Untitled-Design-3-568x319.png.webp" class="attachment-medium size-medium wp-post-image" alt="The State of Ransomware in the U.S.: Report and Statistics 2025" title="The State of Ransomware in the U.S.: Report and Statistics 2024" decoding="async" srcset="https://www.emsisoft.com/en/blog/wp-content/uploads/2025/01/Copy-of-Untitled-Design-3-568x319.png.webp 568w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/01/Copy-of-Untitled-Design-3-730x411.png.webp 730w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/01/Copy-of-Untitled-Design-3-300x169.png.webp 300w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/01/Copy-of-Untitled-Design-3-768x432.png.webp 768w, https://www.emsisoft.com/en/blog/wp-content/uploads/2025/01/Copy-of-Untitled-Design-3.png.webp 1280w" sizes="(max-width: 568px) 100vw, 568px" /> <div class="card__time">13 min read</div> </a> <div class="card__content"> <ul class="card__menu"> <li class="time-item">Jan 9, 2025</li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/commentaries/">Commentaries</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/malware-lab/ransomware/">Ransomware</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/spotlight-ransomware/">Spotlight on Ransomware</a></li> </ul> <a href="https://www.emsisoft.com/en/blog/46288/the-state-of-ransomware-in-the-u-s-report-and-statistics-2024/" title="Read more..."> <h3 class="card__title">The State of Ransomware in the U.S.: Report and Statistics 2024</h3> <p class="card__excerpt">This report presents a comprehensive analysis of the current state of ransomware attacks, with a focus on the impact on US government, education, and healthcare sectors. It includes insights gained from some of the major attacks in 2024.</p> </a> </div> </article> <article class="card post-45911"> <time datetime="2024-08-16T15:54:44+02:00">Aug 16, 2024</time> <a href="https://www.emsisoft.com/en/blog/45911/ransomware-prevention-guide-for-managed-service-providers/" title="Read more..." class="card__image"> <img width="568" height="319" src="https://www.emsisoft.com/en/blog/wp-content/uploads/2024/08/8-568x319.png.webp" class="attachment-medium size-medium wp-post-image" alt="Ransomware Prevention Guide for (MSPs) Managed Service Providers" title="Ransomware Prevention Guide for Managed Service Providers" decoding="async" srcset="https://www.emsisoft.com/en/blog/wp-content/uploads/2024/08/8-568x319.png.webp 568w, https://www.emsisoft.com/en/blog/wp-content/uploads/2024/08/8-730x411.png.webp 730w, https://www.emsisoft.com/en/blog/wp-content/uploads/2024/08/8-300x169.png.webp 300w, https://www.emsisoft.com/en/blog/wp-content/uploads/2024/08/8-768x432.png.webp 768w, https://www.emsisoft.com/en/blog/wp-content/uploads/2024/08/8.png.webp 1280w" sizes="(max-width: 568px) 100vw, 568px" /> <div class="card__time">4 min read</div> </a> <div class="card__content"> <ul class="card__menu"> <li class="time-item">Aug 16, 2024</li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/">Protection Guides</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/malware-lab/ransomware/">Ransomware</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/security-essentials/">Security Essentials</a></li> <li><a href="https://www.emsisoft.com/en/blog/category/protection-guides/spotlight-ransomware/">Spotlight on Ransomware</a></li> </ul> <a href="https://www.emsisoft.com/en/blog/45911/ransomware-prevention-guide-for-managed-service-providers/" title="Read more..."> <h3 class="card__title">Ransomware Prevention Guide for Managed Service Providers</h3> <p class="card__excerpt">This comprehensive ransomware prevention guide outlines a strategic approach to preventing ransomware attacks, drawing upon industry best practices, compelling statistics, and expert insights. </p> </a> </div> </article> </ul> </section> <section class="newsletter-footer newsletter-form-wrapper Form" data-ga-text="blog footer"> <div class="container"> <div class="replace"> <div class="columns"> <div class="column"> <h2>Newsletter</h2> <p>Malware never sleeps. Be sure to stay up-to-date on emerging threats.</p> </div> <form action="https://www.emsisoft.com/en/blog/post-ajax.php?token=19f13936ff" class="form_ajax column" method="post" novalidate> <input type="hidden" id="_wpnonce" name="_wpnonce" value="19f13936ff" /><input type="hidden" name="_wp_http_referer" value="/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/" /> <input type="text" id="txtName" name="txtName" placeholder="Name..." title="Name..."> <input type="email" id="txtEmail" name="txtEmail" placeholder="Email..." title="Email..."> <button type="submit" class="button">Subscribe</button> <span class="emails-opt-wrapper"><input type="checkbox" name="emails-opt" id="emails-opt" value="1" required> <label for="emails-opt">Emsisoft requires collection and processing of certain personal data to provide the services. Please confirm that you have read and accept the terms of our <a href="https://www.emsisoft.com/en/privacy/" target="_blank">Privacy Policy</a>.</label></span></form> </div> </div> <div class="newsletterErrorMessage"></div> </div> </section> <div class="breadcrumbs"><div class="container"><span><span><a href="https://www.emsisoft.com/en/">Emsisoft</a></span> <span class="breadcrumb_separator">&gt;</span> <span><a href="https://www.emsisoft.com/en/blog/">Blog</a></span> <span class="breadcrumb_separator">&gt;</span> <span><a href="https://www.emsisoft.com/en/blog/category/malware-lab/">Malware Lab</a></span> <span class="breadcrumb_separator">&gt;</span> <span><a href="https://www.emsisoft.com/en/blog/category/malware-lab/ransomware/">Ransomware</a></span> <span class="breadcrumb_separator">&gt;</span> <span class="breadcrumb_last" aria-current="page">How ransomware attackers evade your organizationâs security solutions</span></span></div></div><footer class="footer footer-fat"> <div class="container">

1 <div class="footer__columns"><div class="column"><h3>PRODUCTS</h3><div class="menu-footer_c1_products_en-container"><ul id="menu-footer_c1_products_en" class="menu"><li id="menu-item-35277" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-35277"><a href="https://www.emsisoft.com/en/business-security/">Emsisoft Business Security</a></li><li id="menu-item-41450" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41450"><a href="https://www.emsisoft.com/en/enterprise-security/">Emsisoft Enterprise Security</a></li><li id="menu-item-41451" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41451"><a href="https://www.emsisoft.com/en/remediation-kit/">Emsisoft Remediation Kit</a></li><li id="menu-item-35275" class="border-top menu-item menu-item-type-custom menu-item-object-custom menu-item-35275"><a href="https://www.emsisoft.com/en/anti-malware-home/">Emsisoft Anti-Malware Home</a></li><li id="menu-item-35280" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-35280"><a href="https://www.emsisoft.com/en/emergency-kit/">Emsisoft Emergency Kit</a></li><li id="menu-item-35276" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-35276"><a href="https://www.emsisoft.com/en/mobile-security/">Emsisoft Mobile Security</a></li></ul></div></div><div class="column"><h3>KEY BENEFITS</h3><div class="menu-footer_c2_benefits_en-container"><ul id="menu-footer_c2_benefits_en" class="menu"><li id="menu-item-44102" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-44102"><a href="https://www.emsisoft.com/en/layered-protection/">Layered Protection</a></li><li id="menu-item-44539" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-44539"><a href="https://www.emsisoft.com/en/anti-ransomware/">Anti-Ransomware</a></li><li id="menu-item-43729" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-43729"><a href="https://www.emsisoft.com/en/management-console/">Centralized Management</a></li><li id="menu-item-43730" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-43730"><a href="https://www.emsisoft.com/en/endpoint-detection-and-response/">Endpoint Detection &#038; Response</a></li><li id="menu-item-44436" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-44436"><a href="https://www.emsisoft.com/en/threat-hunting/">Threat Hunting</a></li><li id="menu-item-44869" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-44869"><a href="https://www.emsisoft.com/en/ransomware-rollback/">Ransomware Rollback</a></li><li id="menu-item-45312" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-45312"><a href="https://www.emsisoft.com/en/behavior-ai/">Behavior AI</a></li></ul></div></div><div class="column"><h3>Knowledge</h3><div class="menu-footer_c3_knowledge_en-container"><ul id="menu-footer_c3_knowledge_en" class="menu"><li id="menu-item-41455" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-home menu-item-41455"><a href="https://www.emsisoft.com/en/blog/">News Blog</a></li><li id="menu-item-41456" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-41456"><a href="https://www.emsisoft.com/en/blog/category/enterprise-security/">Enterprise Security</a></li><li id="menu-item-41457" class="menu-item menu-item-type-taxonomy menu-item-object-category current-post-ancestor menu-item-41457"><a href="https://www.emsisoft.com/en/blog/category/malware-lab/">Malware Lab</a></li><li id="menu-item-41474" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41474"><a href="https://www.emsisoft.com/en/help/">Product User Guides</a></li><li id="menu-item-41475" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41475"><a href="https://www.youtube.com/emsisoft">Video Tutorials</a></li></ul></div></div><div class="column"><h3>Support</h3><div class="menu-footer_c4_support_en-container"><ul id="menu-footer_c4_support_en" class="menu"><li id="menu-item-41460" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41460"><a href="https://www.emsisoft.com/en/help/">Contact Us</a></li><li id="menu-item-41461" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-41461"><a href="https://www.emsisoft.com/en/help/contact/?c=submit">

1Submit a suspicious file</a></li></ul></div></div><div class="column"><h3>COMPANY</h3><div class="menu-footer_c5_company_en-container"><ul id="menu-footer_c5_company_en" class="menu"><li id="menu-item-35295" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-35295"><a href="https://www.emsisoft.com/en/why-emsisoft/">About Us</a></li><li id="menu-item-43666" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-43666"><a href="https://www.emsisoft.com/en/our-customers/">Our Customers</a></li><li id="menu-item-35298" class="menu-item menu-item-type-taxonomy menu-item-object-category menu-item-35298"><a href="https://www.emsisoft.com/en/blog/category/emsisoft-news/">Awards &#038; Reviews</a></li><li id="menu-item-35297" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-35297"><a href="https://www.emsisoft.com/en/press/">Press Center</a></li><li id="menu-item-35296" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-35296"><a href="https://www.emsisoft.com/en/careers/">Careers</a></li><li id="menu-item-43506" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-43506"><a href="https://www.emsisoft.com/en/webinars/">Webinars</a></li><li id="menu-item-43718" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-43718"><a href="https://www.emsisoft.com/en/podcast/">Podcast</a></li></ul></div></div> </div> </div> <div class="footer__bottom"> <div class="container"> <div class="footer__logo"> <a href="https://www.emsisoft.com/en/" title="Emsisoft" style="-webkit-mask-image: url('https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/layout/logo.svg?id=c0f87631c419e4c180b87dfa3151a3c3');mask-image: url('https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/images/layout/logo.svg?id=c0f87631c419e4c180b87dfa3151a3c3')"></a> </div> <div class="footer__note text-center"><a href="https://www.emsisoft.com/en/legal/">&copy; 2003-2026 Emsisoft - 09/22/2026 - Legal Notice</a> - <a href="https://www.emsisoft.com/en/terms/">Terms</a> - <a href="https://www.emsisoft.com/en/privacy/">Privacy Policy</a> -&nbsp;<a href="https://www.emsisoft.com/en/cookie-policy/">Cookie Policy</a> -&nbsp;<a href="https://status.emsisoft.com/" target="_blank" rel="noopener noreferrer">System Status</a> -&nbsp;<div class="menu-footer_en-container"><ul id="menu-footer_en" class="language-menu"><li id="menu-item-28627" class="lang-dropdown menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-28627"><a href="#">English</a><ul class="sub-menu"><li id="menu-item-1108" class="lang-item lang-item-1108 lang-item-en current-lang lang-item-first menu-item-1108"><a href="https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/">English</a></li><li id="menu-item-1111" class="lang-item lang-item-1111 lang-item-de menu-item-1111"><a href="https://www.emsisoft.com/de/blog/36818/so-umgehen-ransomware-angreifer-die-sicherheitsloesungen-ihres-unternehmens/">Deutsch</a></li></ul></li></ul></div> </div> <ul class="footer__social-media"> <li><a href="https://www.emsisoft.tv" target="_blank" rel="noopener noreferrer" class="icon icon-youtube"><span>Emsisoft YouTube</span></a></li> <li><a href="https://www.linkedin.com/company/emsisoft" target="_blank" rel="noopener noreferrer" class="icon icon-linkedin"><span>Emsisoft LinkedIn</span></a></li> <li><a href="https://www.facebook.com/Emsisoft/" target="_blank" rel="noopener noreferrer" class="icon icon-facebook"><span>Emsisoft Facebook</span></a></li> <li><a href="https://twitter.com/emsisoft" target="_blank" rel="noopener noreferrer" class="icon icon-twitter-x"><span>Emsisoft Twitter</span></a></li><li><a href="https://www.emsisoft.com/en/blog/feed/" target="_blank" rel="noopener noreferrer" class="icon icon-rss"><span>Emsisoft RSS Feed</span></a></li> </ul> </div> </div> </footer>

1<script type="speculationrules"> {"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/en/blog/*"},{"not":{"href_matches":["/en/blog/wp-*.php","/en/blog/wp-admin/*","/en/blog/wp-content/uploads/*","/en/blog/wp-content/*","/en/blog/wp-content/plugins/*","/en/blog/wp-content/themes/emsisoft_blog/*","/en/blog/wp-content/themes/emsisoft_base/*","/en/blog/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]} </script>

1 <ul class="wpsr-text-sb wpsr-tsb-32px wpsr-clearfix" data-content="article" data-tcount="20" data-url="https://www.emsisoft.com/en/blog/36786/how-ransomware-attackers-evade-your-organizations-security-solutions/" data-title="How ransomware attackers evade your organizationâs security solutions" data-surl="https://www.emsisoft.com/en/blog/?p=36786" data-tuname="@emsisoft" data-comments-section="comments" style="background-color:#333;"><li><a data-link="https://www.facebook.com/share.php?u={url}&amp;quote={excerpt}" data-id="facebook" style="color:#fff;" href="#" target="_blank" title="Share this on Facebook"><i class="fab fa-facebook-f"></i></a></li><li><a data-link="https://twitter.com/intent/tweet?text={excerpt}%20-%20{url}%20{twitter-username}" data-id="twitter" style="color:#fff;" href="#" target="_blank" title="Tweet this !"><i class="fab fa-twitter"></i></a></li><li><a data-link="https://www.linkedin.com/sharing/share-offsite/?url={url}" data-id="linkedin" style="color:#fff;" href="#" target="_blank" title="Add this to LinkedIn"><i class="fab fa-linkedin-in"></i></a></li><li><a data-link="mailto:?to=&amp;subject={title}&amp;body={excerpt}%20-%20{url}" data-id="email" style="color:#fff;" href="#" target="_blank" title="Email this "><i class="fa fa-envelope"></i></a></li></ul>

1<script id="pll_cookie_script-js-after"> (function() { var expirationDate = new Date(); expirationDate.setTime( expirationDate.getTime() + 31536000 * 1000 ); document.cookie = "pll_language=en; expires=" + expirationDate.toUTCString() + "; path=/; secure; SameSite=Lax"; }()); //# sourceURL=pll_cookie_script-js-after </script>

1<script id="jquery-js" src="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/js/jquery-3.6.3.min.js?id=cf2fbbf84281d9ecbffb4993203d543b"></script>

1<script id="jquery-js-after"> const themeajax = {"url":"https:\/\/www.emsisoft.com\/en\/blog\/post-ajax.php"}; const additionalScriptsBase = {"highlightjs":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/themes\/emsisoft_base\/dist\/js\/highlight.js?id=7aa62cc33378da13bfb13b024bf5428c","tawkchat":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/themes\/emsisoft_base\/dist\/js\/tawkchat.js?id=7d325ae25501334b8423d3eaf04432b9","magnific-popup":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/themes\/emsisoft_base\/dist\/js\/popup.js?id=61784ec1e4a3a48cb44dfa9bf9f27b3f","promo-above":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/themes\/emsisoft_base\/dist\/js\/promo-above.js?id=c085cb66ff8d9c88a4188d9a33452722","contact":"https:\/\/www.emsisoft.com\/en\/blog\/wp-content\/themes\/emsisoft_base\/dist\/js\/contact.js?id=a6fa6437a574c8c5a4cd84bdb31e275a"}; //# sourceURL=jquery-js-after </script>

1<script id="emsisoft-base-blog-script-js" defer src="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_base/dist/js/blog.js?id=475548553625c0fb591e96dd14a24ba6"></script>

1<script id="emsisoft-blog-script-js" defer src="https://www.emsisoft.com/en/blog/wp-content/themes/emsisoft_blog/dist/js/app.js?id=e024fb008b64b1e13baef982246e56e9&#038;ver=974ca3327cec34fa9fd0422d9d5f7b63"></script>

1<script id="emsisoft-recaptcha-enterprise-js-extra"> var recaptchaEnterpriseSiteKey = "6LdyImkeAAAAAPLHS09sEvDMIPB1NWDpDGZkovzw"; //# sourceURL=emsisoft-recaptcha-enterprise-js-extra </script>

vendor: 106 bytes, line 1

1 <script id="emsisoft-recaptcha-enterprise-js" src="https://www.google.com/recaptcha/enterprise.js?render=

16LdyImkeAAAAAPLHS09sEvDMIPB1NWDpDGZkovzw

vendor: 12 bytes, line 1

1"></script>

1<script id="wpsr_main_js-js-extra"> var wp_socializer = {"ajax_url":"https://www.emsisoft.com/en/blog/wp-admin/admin-ajax.php"}; //# sourceURL=wpsr_main_js-js-extra </script>

1<script id="wpsr_main_js-js" defer src="https://www.emsisoft.com/en/blog/wp-content/plugins/wp-socializer/public/js/wp-socializer.min.js?ver=7.9"></script>

1 </body> </html>
2
3<!-- Cachify | https://cachify.pluginkollektiv.org
4Generated @ 22.09.2026 15:17:34 -->

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.