Modern ransomware: Obfuscation and fileless attacks explained

Fileless attacks: the invisible threat

Fileless malware represents a notable shift in ransomware tactics. Unlike traditional ransomware, which installs an executable on disk, fileless attacks run entirely in memory, leaving little or no trace on the file system.

Key characteristics include:

• Use of legitimate tools already present on the system (Living-off-the-Land)
• Direct execution in memory without touching the disk
• Frequent use of PowerShell or the .NET framework
• Persistence through the registry or scheduled tasks

By leveraging native system tools, these attacks are difficult to detect for traditional file-based security solutions. According to Halcyon.ai data from early 2025, Living-off-the-Land techniques now define modern ransomware campaigns, allowing attackers to minimise their digital footprint. Detecting these attacks requires advanced behavioural monitoring solutions.

The modern attack process: Sequential deployment

Modern ransomware attacks are no longer single-step events. They follow a methodical sequence, often spread over days or weeks, to avoid detection. Attackers deposit their payload incrementally, remaining unnoticed until the final encryption stage.

Typical stages of a fileless attack include:

1. Initial execution: Base64-encoded PowerShell scripts, often delivered via malicious documents
2. Persistence establishment: Scheduled tasks or registry modifications
3. Internal reconnaissance: Mapping the network and identifying high-value targets
4. Lateral movement: Propagating through vulnerabilities or compromised credentials
5. Memory injection: Loading malicious code directly into legitimate process memory
6. Data exfiltration: Stealing sensitive information before encryption (double extortion)
7. Final deployment: Executing the full encryption payload

This staged approach maximises impact while reducing the chance of early detection. SOC teams use advanced event correlation to detect these sequences and respond promptly.

The strategic use of malicious DLLs

Malicious DLLs (Data Definition Language) are central to many modern ransomware attacks. Often developed in .NET, these libraries are obfuscated and loaded directly into memory. Their main functions include:

• Calling system functions
• Bypassing security mechanisms
• Facilitating lateral movement
• Executing encryption routines

Nomios SOC analyses show that reconstructing a malicious DLL can take several days of intensive work, even for experienced experts.

As revealed by a recent incident blocked by the Nomios SOC, complete reconstruction of a malicious DLL can require several days of intensive forensic analysis work, even for seasoned experts.

Polymorphic ransomware

Polymorphic ransomware adds another layer of sophistication. It constantly modifies its code and signature, generating unique variants with each infection. Techniques include:

• Code mutation during execution
• Random code generation
• Insertion of harmless instructions
• Dynamic reorganisation of functions

These capabilities make detection by traditional solutions nearly impossible.

Defence strategies against advanced ransomware

Defending against these threats requires a layered approach that combines technology with expertise:

1. Enhancing behavioural detection

• Deploy EDR (Endpoint Detection and Response) solutions capable of analysing behaviour rather than relying solely on signatures
• Enable advanced logging of PowerShell and scripts
• Implement behavioural anomaly detection systems

2. Limiting the attack surface

• Restrict execution of unsigned PowerShell scripts
• Apply the principle of least privilege to limit lateral propagation
• Segment the network to contain potential infections

3. Strengthening digital forensics

• Develop skills in volatile memory analysis
• Implement network traffic capture and analysis tools
• Establish incident response procedures specific to fileless attacks

4. Integrating a modern SOC

• 24/7 infrastructure monitoring
• Behavioural analysis capabilities
• Expertise in detecting obfuscation and fileless attacks
• Rapid incident response procedures

Ransomware using obfuscation, fileless execution, and polymorphic techniques is increasingly hard to detect and analyse. The most effective defence combines advanced SOC technology, skilled analysts, and an organisation-wide security culture.

Expert Insights

Ransomware using obfuscated code and fileless attack techniques represents a major threat to organisations in 2025. Their increasing sophistication, combined with the adoption of polymorphic techniques, makes their detection and analysis increasingly complex.

For analysts and cybersecurity managers, understanding these advanced mechanisms is essential to implement effective defence strategies. Beyond technical solutions, it is a race for expertise between defenders and attackers that continues.

Faced with this constantly evolving threat, the most effective approach remains the combination of advanced SOC technology, high-level human expertise, and a security culture shared by the entire organisation.