--- title: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection description: A new ransomware variant avoided detection by being spread through a spear phishing email campaign as an obfuscated PowerShell script. Many traditional anti-malware solutions are not ready for the next generation of ransomware attacks. Acronis, however, has been very successful. canonical_url: https://www.acronis.com/en/blog/posts/undetected-powershell-ransomware-easily-blocked-acronis-active-protection/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection A new ransomware variant avoided detection by being spread through a spear phishing email campaign as an obfuscated PowerShell script. Many traditional anti-malware solutions are not ready for the next generation of ransomware attacks. Acronis, however, has been very successful. [Learn More](https://www.acronis.com/en/products/cyber-protect/) [![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team") [MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/) 7 min read Last updated 24 July 2026 A new [ransomware](https://www.acronis.com/en-us/ransomware-protection/) variant avoided detection by being spread through a spear phishing email campaign as an obfuscated PowerShell script. Many traditional anti-malware solutions are not ready for the next generation of ransomware attacks, [according to NioGuard Security Lab](https://www.acronis.com/en-us/blog/posts/nioguard-security-lab-are-you-protected-next-generation-ransomware-attacks). Acronis, however, has been successful in detecting and blocking recent zero-day ransomware attacks. Virustotal showed 0/57 detection ratio on July 9, 2017. Two days later, still, more than a half of the tested anti-malware programs were incapable of detecting this type of dangerous ransomware. ![Image 3: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/d07c51b2145de29bee79300607263a2c.png) ![Image 4: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/3af9ead8c39ac993aad3f76fd0ab8359.png) ## Ransomware delivery method The malicious JS (Readable Msg-j8k5b798d4.js) is delivered in a ZIP archive (EML_j8k5b798d4.zip) attached to a fake delivery status notification email that supposedly contained a letter blocked by a spam filter. ![Image 5: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/88b9ae8c5d3cff974b5f639819cef5b0.png) Once extracted and executed by the user, the JavaScript starts a PowerShell console and sends the deobfuscated shell script to it: "C:\Windows\system32\windowspowershell\v1.0\powershell.exe" iex $env:LoadShellCodeScript ![Image 6: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/9a27fe987e7cb85f03684bb2f9e82c9b.png) ## Data encryption First, three random Base64-like strings are generated: * String1 * String2 * UUID ​ ![Image 7: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/17c546a4fa0b9364ab6bc21d0cf60ec0.png) These strings are sent to a remote server and used to generate the Rijndael session key. The Rijndael key is generated using the ‘Rfc2898DeriveBytes’ class. The constructor accepts the following parameters to create a cryptographic object: * string1 - the password used to derive the key; * hex_byte_array(string2) - the key salt used to derive the key; * 5 - the number of iterations to generate the Rijndael key. The initialization vector (IV) is calculated as first 16 bytes of the SHA-1 hash from the word ‘alle’. Both IV and key are the same for all files. It uses the Rijndael encryption algorithm with a 256-bit key and CBC mode. ​ ![Image 8: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/5a99a9ce8da13111d11946f286cbe7c2.png) The cryptolocker encrypts the first 4096 bytes of the file and if the file size is greater than that, or the entire file if the file size is lower. ![Image 9: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/502e04182e610f65153a6e00fe2bbe9f.png) The ransom note is decoded from a Base64 string and a Personal ID is added at the end. The ID is generated randomly earlier. The html file with the ransom note named ‘_README-Encrypted-Files.html’ is dropped in the folders with encrypted files. ![Image 10: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/30a4976b59e6c9d91de52f861e21462e.png) The PowerShell ransomware encrypts files having the following extensions: yuv, ycbcra, xis, x3f, x11, wpd, tex, sxg, stx, st8, st5, srw, srf, sr2, sqlitedb, sqlite3, sqlite, sdf, sda, sd0, s3db, rwz, rwl, rdb, rat, raf, qby, qbx, qbw, qbr, qba, py, psafe3, plc, plus_muhd, pdd, p7c, p7b, oth, orf, odm, odf, nyf, nxl, nx2, nwb, ns4, ns3, ns2, nrw, nop, nk2, nef, ndd, myd, mrw, moneywell, mny, mmw, mfw, mef, mdc, lua, kpdx, kdc, kdbx, kc2, jpe, incpas, iiq, ibz, ibank, hbk, gry, grey, gray, fhd, fh, ffd, exf, erf, erbsql, eml, dxg, drf, dng, dgc, des, der, ddrw, ddoc, dcs, dc2, db_journal, csl, csh, crw, craw, cib, ce2, ce1, cdrw, cdr6, cdr5, cdr4, cdr3, bpw, bgt, bdb, bay, bank, backupdb, backup, back, awg, apj, ait, agdl, ads, adb, acr, ach, accdt, accdr, accde, ab4, 3pr, 3fr, vmxf, vmsd, vhdx, vhd, vbox, stm, st7, rvt, qcow, qed, pif, pdb, pab, ost, ogg, nvram, ndf, m4p, m2ts, log, hpp, hdd, groups, flvv, edb, dit, dat, cmt, bin, aiff, xlk, wad, tlg, st6, st4, say, sas7bdat, qbm, qbb, ptx, pfx, pef, pat, oil, odc, nsh, nsg, nsf, nsd, nd, mos, indd, iif, fpx, fff, fdb, dtd, design, ddd, dcr, dac, cr2, cdx, cdf, blend, bkp, al, adp, act, xlr, xlam, xla, wps, tga, rw2, r3d, pspimage, ps, pct, pcd, m4v, fxg, flac, eps, dxb, drw, dot, db3, cpi, cls, cdr, arw, ai, aac, thm, srt, save, safe, rm, pwm, pages, obj, mlb, md, mbx, lit, laccdb, kwm, idx, html, flf, dxf, dwg, dds, csv, css, config, cfg, cer, asx, aspx, aoi, accdb, 7zip, 1cd, xls, wab, rtf, prf, ppt, oab, msg, mapimail, jnt, doc, dbx, contact, n64, m4a, m4u, m3u, mid, wma, flv, 3g2, mkv, 3gp, mp4, mov, avi, asf, mpeg, vob, mpg, wmv, fla, swf, wav, mp3, qcow2, vdi, vmdk, vmx, wallet, upk, sav, re4, ltx, litesql, litemod, lbf, iwi, forge, das, d3dbsp, bsa, bik, asset, apk, gpg, aes, ARC, PAQ, tar.bz2, tbk, bak, tar, tgz, gz, 7z, rar, zip, djv, djvu, svg, bmp, png, gif, raw, cgm, jpeg, jpg, tif, tiff, NEF, psd, cmd, bat, sh, class, jar, java, rb, asp, cs, brd, sch, dch, dip, pl, vbs, vb, js, asm, pas, cpp, php, ldf, mdf, ibd, MYI, MYD, frm, odb, dbf, db, mdb, sql, SQLITEDB, SQLITE3, 011, 010, 009, 008, 007, 006, 005, 004, 003, 002, 001, pst, onetoc2, asc, lay6, lay, ms11, sldm, sldx, ppsm, ppsx, ppam, docb, mml, sxm, otg, odg, uop, potx, potm, pptx, pptm, std, sxd, pot, pps, sti, sxi, otp, odp, wb2, 123, wks, wk1, xltx, xltm, xlsx, xlsm, xlsb, slk, xlw, xlt, xlm, xlc, dif, stc, sxc, ots, ods, hwp, 602, dotm, dotx, docm, docx, DOT, 3dm, max, 3ds, xml, txt, CSV, uot, RTF, pdf, XLS, PPT, stw, sxw, ott, odt, DOC, pem, p12, csr, crt, key ## C&C Communication The PowerShell script sends the check-in request to the remote server hxxp://joelosteel.gdn/pi.php using the HTTP protocol. The request contains three strings (password, salt, and UUID). First two are used to create the encryption key. ![Image 11: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/ee3a15aefc4dadb861ddbc05847ece7e.png) After the check-in request is sent, the script sleeps for 2 min and goes on to files encryption. The remote server’s IP is registered to DigitalOcean, LLC and is located in New York City, US: ![Image 12: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/bb7df706df56280ac49c5d1ee01271e6.png) ![Image 13: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/e8d40dc019b69b12f6c0ddaad9a83ab0.png) The decryption service is hosted in the Tor network: http://5zzfhzftspadlgje.onion.to At the moment of writing this report, the decryption service was not responsive. ## Deleting Shadow Copies At the end, the script deletes shadow copies of files: ![Image 14: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/20ffaa12774c36a7ac186e79e40e5568.png) ## Conclusion * Being an obfuscated script (JS, PowerShell) the ransomware easily bypasses antivirus protection. * The ransomware is delivered as a targeted attack using spear-phishing emails. * The PowerShell cryptolocker uses Rijndael encryption algorithm with the key length 256 bits. The strings used to derive the key are sent to the attacker. Therefore, victims can not decrypt files without getting access to the ISP’s HTTP traffic dump. * The ransomware deletes shadow copies (backup versions) of files. ## Acronis True Image blocks PowerShell ransomware Acronis True Image blocks the encryption attack and lets users restore affected files. 1. Acronis TrueImage detects ransomware activity: ![Image 15: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/50af6d8b2a7375555234c021a9e32301.png) 2. Clicking the Recover files button restores the affected files. ![Image 16: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/ee3623c062d1928b17bdcffb4ff6adf2.png) The files have been successfully recovered. ![Image 17: Undetected PowerShell Ransomware Easily Blocked by Acronis Active Protection](https://staticfiles.acronis.com/images/content/a0aaccc4ee780c0fc1818c5dd61b2c00.png) Try [Acronis True Image](https://www.acronis.com/en-us/personal/computer-backup/) Now! [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/) ## Written by ![Image 18: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png) MSP Threats Security Team [Previous post](https://www.acronis.com/en/blog/posts/simple-way-copy-data-android-smartphone-iphone-and-vice-versa/) [A Simple Way to Copy Data From an Android to iPhone (and Vice Versa)](https://www.acronis.com/en/blog/posts/simple-way-copy-data-android-smartphone-iphone-and-vice-versa/) [Next post](https://www.acronis.com/en/blog/posts/ransomware-attack-wasnt/) [The Ransomware Attack That Wasn’t](https://www.acronis.com/en/blog/posts/ransomware-attack-wasnt/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 19: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 20: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png) [Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/) We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet. **October 15, 2026**2 min read ![Image 21: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read