Ransomware in the honeypot: how we capture keys with sticky canary files

As cited

Copy frozen at 2026-09-19 12:04 UTC (site build).

ransomware

Ransomware in the honeypot: how we capture keys with sticky canary files

Elastic Defend ransomware protection uses sticky canary files deployed in honeypots to capture encryption keys during ransomware attacks. The technique allows defenders to extract cryptographic material that ransomware operators use to encrypt victim data, potentially enabling decryption without paying a ransom.

Why it matters: Security teams running Elastic Defend can use this key-capture technique to recover encrypted data or assist law enforcement, reducing the financial impact of ransomware incidents.

Source published

2024-02-23 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-19 11:15 UTC