Unveiling evasive ransomware and breaking through the predicament: a comprehensive review of evasion techniques and defense mechanisms

Abstract Ransomware has become one of the most destructive cyberattacks worldwide in recent years and has caused billions of dollars. Numerous defense mechanisms have been proposed to mitigate the ransomware threat. However, as attack technologies advance, ransomware has rapidly evolved. It employs sophisticated techniques to evade traditional defense mechanisms and has lead to devastating impacts on organizations globally. While many studies have focused on ransomware and its defense, none have provided a comprehensive overview of the ongoing battle between defense mechanisms and the evolving ransomware. They also do not explore the techniques employed by ransomware authors to evade detection. To fill this gap and motivate further research, we conduct an extensive investigation into evasive ransomware, including the common techniques they employ and the efforts researchers have made to counter them. Based on this, we offer a preliminary exploration of potential defense concepts that track multi-level events across different attack stages and leverage the correlations between them to construct the attack flow. This paper helps researchers in the ransomware field gain a comprehensive understanding of evasive ransomware. It also offers insights for future researchers to enhance defense mechanisms to cover the potential threats identified in this study, minimizing the losses caused by evasive ransomware.