Evasive ransomware: how modern attacks defeat EDR, and what to do about it

What 'evasive ransomware' actually means

Evasive ransomware is not a single strain. It is a design philosophy shared across otherwise unrelated groups. The idea is simple: an endpoint tool can only stop what it can see, so build the attack to stay out of sight. That shows up in three distinct ways, which often appear together in the same incident. The attacker arrives without malware, disables the security tool before doing anything noisy, or operates on a device the tool was never installed on. Each defeats a different assumption that endpoint defense is built on.

None of this is theoretical or rare anymore. It is the mainstream of serious ransomware in 2026, and the numbers behind each technique have moved from alarming to routine. We will take the three paths in turn, with the public evidence for each, and then get to what a defender can actually do about it.

Path 1: arrive with no malware at all

The biggest shift is that modern intrusions often involve no malicious file for an endpoint tool to detect. CrowdStrike's 2026 Global Threat Report found that 82% of detections in 2025 were malware-free, and that most initial access now relies on stolen or purchased credentials rather than a dropped payload. Once inside, attackers 'live off the land,' using the legitimate tools already on the system, PowerShell, WMI, and the rest, to move and escalate.

To an endpoint agent, an administrator using PowerShell looks a lot like an administrator using PowerShell. When the intruder holds a valid credential and uses sanctioned tools, there is frequently no obviously malicious binary to flag. The Picus Red Report 2026 found that 80% of the top attacker techniques are now dedicated to evasion and persistence rather than to dropping detectable malware. The attackers have, in effect, optimized themselves against exactly the thing endpoint tools do best.

Path 2: turn the EDR off before encrypting

When attackers do need to run something an endpoint tool would catch, the now-standard move is to disable the tool first. The technique is 'bring your own vulnerable driver' (BYOVD): load a legitimately signed but flawed driver, exploit it to gain kernel-level control, and from there kill or blind the security agent. These purpose-built tools are known in the trade as EDR killers.

The scale is striking. A March 2026 analysis reported by The Hacker News found 54 distinct EDR killers abusing 35 different signed vulnerable drivers, with others using scripts or legitimate anti-rootkit software. In April 2026, groups tied to Qilin and Warlock were documented using BYOVD to silence more than 300 EDR and security products, per Cisco Talos and Trend Micro. Newer families like Reynolds now bundle the EDR killer directly into the ransomware payload rather than deploying it as a separate step, and CISA's Akira advisories describe the group using POORTRY to tamper with drivers and even booting machines into Safe Mode to start them with the security agent disabled. Different groups, same conclusion: disable the defender, then encrypt.

Path 3: operate where no agent can run

The third path is the one that matters most in healthcare and the public sector. An endpoint tool needs an agent, and a large share of a modern network cannot run one: medical devices, imaging controllers, building systems, cameras, printers, and other embedded gear. In a case reported by BleepingComputer in 2025, the Akira group was blocked by EDR on the victim's Windows machines, so it scanned the network, found an unsecured webcam running a stripped-down Linux OS with no agent, and launched its encryption from the camera across network file shares. The endpoint tool did its job on the machines it could see. The attack succeeded anyway.

For a hospital running ten to fifteen thousand connected devices, this is not an edge case. It is the shape of the modern attack. Any defense that lives only on managed endpoints has a structural blind spot the attacker will find.

Why this is a strategy problem, not a product problem

The temptation is to respond by buying a better endpoint tool. That misreads the situation. Every technique above is specifically designed to defeat the endpoint layer, no matter how good it is, by not being on it, by turning it off, or by acting where it cannot reach. Doubling down on the layer attackers have already engineered around is not a plan. This is not an argument to drop EDR, which still stops a great deal. It is an argument that EDR cannot be the last line.

The honest reframing is that prevention and detection will sometimes fail against a determined, evasive adversary, so the question becomes what happens in the minutes after they succeed. That is a resilience question, and it is answered with controls that do not depend on the endpoint seeing the attack.

What actually catches evasive ransomware

The controls that hold up against evasion share one property: they do not rely on spotting malware on an endpoint. In practice, that means four things working together.

• Network-level detection that sees lateral movement and command-and-control regardless of which device the attacker uses, including the agentless ones.
• Deception, with decoy files and systems that a legitimate user never touches, so an intruder operating without malware still trips a high-confidence alarm, often within a couple of seconds.
• Continuous access verification that scores behavior rather than trusting a valid login, so a stolen credential acting out of character is caught even when nothing malicious runs.
• Fast containment and self-healing recovery from immutable backups, so even an attack that reaches encryption becomes a contained, recoverable event rather than a shutdown.

How Immune fits

This is the layer we built Immune to be. We watch the network and hosts, plant deception, and verify access continuously, then fuse those signals into one explainable verdict and contain a confirmed threat in seconds, including on the devices an agent can never cover. If encryption gets through, we restore from immutable, air-gapped backups that an attacker cannot alter or delete.

The point is not to replace your endpoint tool. Keep it. The point is to stop making it the thing your whole defense depends on, because evasive ransomware has spent two years proving that bet no longer pays. If you want the fuller argument, see our pillar piece on whether EDR is enough to stop ransomware.