How should security teams defend against ransomware that changes its code at runtime?

Why This Matters for Security Teams

Ransomware that changes its code at runtime is designed to defeat signature-led detection, so the real question is whether defenders can still catch the attacker’s behaviour when the binary itself is unstable. That shifts the emphasis from samples to actions: process spawning, script execution, credential access, network discovery, and encryption patterns that remain visible even when the payload mutates. Guidance from CISA cyber threat advisories continues to stress behaviour-based detection because adversaries regularly combine living-off-the-land techniques with malware modification to stay ahead of static controls.

This also matters because runtime polymorphism often coexists with credential theft and lateral movement. NHI Management Group’s analysis of credential-driven intrusions, including MGM Resorts Breach 2023, shows how quickly attackers turn access into operational impact once they are inside. In practice, many security teams encounter this only after a workstation starts encrypting shares and the first helpdesk ticket reveals that the malware never looked the same twice.

How It Works in Practice

Defending against runtime-changing ransomware starts with assuming that the executable is a moving target. Static hashes, file names, and YARA-style signatures still have value, but they are no longer enough on their own. Teams need detection points that survive code mutation: suspicious parent-child process chains, PowerShell or script interpreter abuse, rapid directory enumeration, shadow copy deletion, file renaming at scale, and concurrent encryption activity across endpoints and servers. Behavioural detections should be tuned to the chain of actions, not just the presence of a known bad binary.

That is where layered telemetry matters. Endpoint detection and response can surface command execution and process ancestry, while sandboxing can force the sample to reveal timing, unpacking, or delayed execution patterns. Memory inspection helps catch injected or unpacked code that never exists cleanly on disk. Hardening script interpreters reduces the attacker’s ability to pivot from a mutated payload into an interactive control plane. The practical goal is to create control points the ransomware cannot easily recompile around.

Current guidance from CISA cyber threat advisories and the ENISA Threat Landscape is to pair prevention with rapid containment, because polymorphic ransomware often succeeds when defenders rely on one layer alone. For organisations tracking real-world intrusion patterns, NHIMG’s Codefinger AWS S3 ransomware attack analysis is a useful reminder that attackers increasingly target data paths and access pathways, not just endpoints. These controls tend to break down in flat Windows domains with excessive scripting privilege because malware can spread, stage, and encrypt faster than policy enforcement catches up.

• Alert on bulk file modifications, archive creation, and extension changes across many directories in a short window.
• Correlate suspicious command shells with unusual process ancestry and outbound connections.
• Inspect memory for unpacked payloads and injected code after the initial execution stage.
• Restrict PowerShell, WScript, macro execution, and remote admin tools to approved administrative workflows.
• Preserve immutable backups and isolate recovery paths so runtime mutation does not block restoration.

Common Variations and Edge Cases

Tighter behavioural detection often increases operational overhead, requiring organisations to balance early warning against noise from legitimate admin activity, software deployment, and backup jobs. That tradeoff is especially sharp in VDI fleets, build servers, and patch windows, where high-volume file change is normal and false positives can drown out the signal. Best practice is evolving toward environment-specific baselines rather than universal thresholds.

There is also no universal standard for when to trigger full containment versus watch-and-wait on a polymorphic sample. Some teams isolate on first encryption-like behaviour; others require a stronger confidence score that combines interpreter abuse, privilege escalation, and lateral movement. For highly distributed environments, the best control is often not the same everywhere: cloud workloads may benefit more from identity and workload restrictions, while endpoint-heavy estates need aggressive EDR containment. NHIMG’s The State of Secrets in AppSec reinforces the broader lesson that control fragmentation and weak operational discipline undermine response speed, even when tooling exists. Runtime-changing ransomware succeeds most often where defenders treat detection as a product setting instead of a continuously tuned operational process.

Related resources from NHI Mgmt Group

• How should security teams defend against multi-stage QR code phishing?
• How should security teams defend against AI-driven ransomware entry points?
• What should security teams do when malware source code appears publicly on GitHub?
• How should security teams prevent malicious VS Code tasks from executing in developer workspaces?