Catching the Ransomware EDR Couldn't See

In a Darktrace blog post published on 13 February 2025, a lab-led ransomware scenario demonstrated how an up-to-date EDR could be bypassed using a ClickFix social engineering technique. The attack delivered an obfuscated HTML page that, after user interaction, exposed a PowerShell-driven sequence which downloaded and ran a custom C++ binary that encrypted files and spawned a reverse shell.

The report notes that bypassing the EDR did not require highly sophisticated methods; simply altering the Windows API usage or timing of actions sufficed to evade detection. Cado’s forensic platform, now part of Darktrace, was used to import the affected VM and trace the attack chain, revealing how the ransom note was created and how the payload connected to an attacker-controlled C2 server and executed via PowerShell.

The article argues that an EDR alone cannot provide full context for containment and emphasises the value of DFIR tooling for full incident analysis, including linking email provenance to later lateral movement and file modification. According to Darktrace, this underlines the need for robust, cross-domain forensic capabilities beyond endpoint protection.