The operational shutdown of a ransomware brand does not retire the expertise behind it. When ALPHV — the criminal organization operating BlackCat ransomware — collapsed in early 2024 following law enforcement action and a disputed exit from its affiliate program, the technical capabilities its affiliates had developed did not disappear. Those affiliates have since integrated into successor ransomware operations, and the evasion techniques they refined under the BlackCat banner continue to appear in active intrusions targeting legal firms, healthcare organizations, and financial services providers heading into 2025.
What changed after the ALPHV disruption
ALPHV's affiliate program produced some of the most technically capable ransomware operators in recent memory. The group built its ransomware in Rust — a language that produces binaries with unconventional memory characteristics, complicating static analysis and defeating many signature-based detection engines that pattern-match against common PE structures. That technical foundation did not become obsolete when the brand did. Successor campaigns have adopted and extended the same techniques, most notably a cluster of kernel-level evasion methods that exploit persistent gaps in how enterprise EDR platforms are architected and deployed.
Core EDR evasion techniques in active campaigns
Kernel-level defense evasion via BYOVD
Bring Your Own Vulnerable Driver — BYOVD — has become a standard opening move in sophisticated ransomware intrusions. Attackers load a legitimate, digitally signed but vulnerable kernel driver onto the target system and exploit it to terminate EDR sensor processes from the kernel level. Because the driver carries a valid certificate, many endpoint controls will not block its execution. Once the sensor process is killed, the attacker operates without behavioral monitoring for the remainder of the intrusion cycle. Detection requires kernel telemetry and an enforced driver allow-list — neither is a default configuration in most enterprise EDR deployments.
Intermittent encryption and entropy evasion
BlackCat ransomware introduced configurable intermittent encryption — encrypting only a defined percentage of each target file rather than the full file content. Partial encryption is sufficient to render most document formats unreadable. It also defeats two common detection signals: the volume of file I/O operations decreases relative to full-file encryption, and the change in file entropy per I/O event stays below thresholds that trigger ransomware behavioral rules. Organizations relying on entropy-based ransomware detection as a primary control face a documented gap against this technique.
Direct syscalls and API unhooking
Most EDR platforms monitor malicious behavior by inserting hooks into Windows API calls in user-mode memory. When a process calls a sensitive API — LSASS memory access, executable memory allocation, anomalous network connection — the hook intercepts the call and logs or blocks it. Attackers counter this by bypassing user-mode hooks entirely. Direct syscall stubs invoke Windows kernel functions without going through the hooked API layer, and unhooking techniques remove EDR-placed hooks from process memory at runtime. Both methods are present in BlackCat-affiliated toolchains and leave endpoint platforms with no visibility into activity they would otherwise record.
Safe Mode execution
A documented subset of intrusions attributed to BlackCat-affiliated actors has used Windows Safe Mode to execute ransomware payloads. Safe Mode loads a minimal driver set, and most EDR agents do not load in Safe Mode by default. Attackers configure the system to auto-login and execute the payload on reboot, complete the encryption cycle, and return the system to normal mode. This technique requires prior administrative access — it is not an initial-access method — but it reliably eliminates endpoint monitoring at precisely the moment encryption begins.
Why regulated industries remain high-value targets
Legal, healthcare, and financial services organizations share a structural vulnerability: they hold large volumes of data subject to mandatory breach-disclosure requirements. For a ransomware operator, that regulatory exposure is leverage independent of data recovery costs. A firm threatened with regulatory notification — and the client and reputational consequences that follow — faces pressure the encryption event alone would not create. Compliance frameworks that require documented controls also create a predictable attack surface: operators can test their tooling against mandated configurations and predict what regulated organizations are likely to be running before a single intrusion begins.