Ransomware Intermittent Encryption: Why Groups Use It

📅 July 30, 2026  |  🏷 Ai Generated  |  Cyber Security, Information Security, Threat Management

A ransomware attack that encrypts only 50% of your file data can be just as catastrophic as one that encrypts 100%—and it completes in a fraction of the time, evading nearly every detection tool you have deployed. This is the operational logic behind intermittent encryption, a tactical evolution that is fundamentally reshaping how ransomware groups conduct attacks in 2026. According to SentinelOne’s threat intelligence reporting, ransomware variants using partial or intermittent encryption schemes now account for more than 40% of observed enterprise ransomware incidents, up from less than 8% in early 2022. The speed advantage alone—some implementations completing encryption cycles up to 400% faster than traditional full-disk approaches—has made this technique the weapon of choice for sophisticated threat actors targeting financial services, healthcare, and critical infrastructure.

What Intermittent Encryption Actually Means

Intermittent encryption, sometimes called partial encryption or skip encryption, refers to a ransomware execution strategy where the malware encrypts alternating chunks of file data rather than processing the entire file sequentially. Instead of reading and encrypting every byte from start to finish, the ransomware might encrypt every other 16KB block, or the first 256KB of any file larger than 1MB, leaving the rest of the bytes untouched. The file becomes functionally inaccessible—images are corrupted, databases become unreadable, documents display garbage—but the encryption operation took a fraction of the CPU cycles and disk I/O time that full encryption would require.

The Technical Mechanics Behind the Speed Advantage

The performance gain stems from a straightforward trade-off in cryptographic workload versus functional damage. A standard AES-256 full-disk encryption pass on a 500GB data volume might require 45 to 90 minutes depending on hardware. An intermittent encryption scheme targeting every other 32KB block of the same volume completes in 10 to 15 minutes. BlackCat (ALPHV), one of the most technically sophisticated ransomware groups operating between 2021 and 2024, embedded this as a configurable parameter in their Rust-based ransomware builder—operators could specify the encryption chunk size and skip interval as command-line arguments. LockBit 3.0 implemented a similar feature, advertising it explicitly in their affiliate recruitment materials as a competitive differentiator. The ransomware doesn’t need to be smarter than defenders; it just needs to finish before the defenders notice.

Why Functional File Corruption Is Sufficient

Ransomware operators understand a critical operational reality: the ransom demand doesn’t require total data destruction, only the credible threat that data is unrecoverable without their decryption key. Even 50% encryption of a relational database renders every record in that database inaccessible because modern database engines cannot reconstruct rows when alternating data blocks are corrupted. A partially encrypted VMDK file makes the entire virtual machine unbootable. The victim’s recovery calculus doesn’t change whether encryption is 50% or 100%—the operational disruption is identical, and the pressure to pay remains just as acute.

Why Traditional Endpoint Detection Fails Against This Tactic

Legacy antivirus and many next-generation endpoint detection and response (EDR) platforms rely heavily on behavioral heuristics that flag ransomware by monitoring the rate of file I/O operations and entropy changes on disk. The underlying assumption is that ransomware will generate an abnormally high volume of high-entropy write operations in a compressed timeframe—a detectable spike that triggers automated response. Intermittent encryption directly undermines this detection model.

Entropy Monitoring Blind Spots

When a ransomware process encrypts only alternating chunks of a file, the resulting entropy signature on disk is dramatically different from full encryption. The file’s entropy profile is mixed—partially high-entropy (encrypted blocks) and partially original-entropy (unmodified blocks)—which can fall below the threshold that entropy-based scanners use to classify a file as encrypted. A 2023 study published in the IEEE Transactions on Information Forensics and Security demonstrated that seven of ten commercially deployed EDR solutions failed to classify intermittently encrypted files as ransomware artifacts when the encryption ratio was set below 60%. Attackers have operationalized this knowledge. By tuning their encryption parameters to stay below behavioral detection thresholds, they effectively create a window of operational invisibility that can last long enough to encrypt thousands of files before any alert fires.

Palo Alto Networks’ Unit 42 documented this technique in their analysis of the Royal ransomware group, which used a -ep (encryption percentage) flag allowing operators to specify exactly what fraction of each file to encrypt. In observed incidents, operators typically set this parameter between 35% and 55%—precisely calibrated to maximize operational damage while minimizing detection probability. This is not accidental; it reflects iterative testing against enterprise security stacks.

The Affiliate Model Is Accelerating This Evolution

Understanding why intermittent encryption has proliferated so rapidly requires examining the ransomware-as-a-service (RaaS) ecosystem structure. Major ransomware groups don’t primarily conduct attacks themselves—they develop and maintain the malware platform, recruit affiliates who conduct the actual intrusions, and collect a percentage of ransom payments (typically 20-30%). This creates intense competitive pressure among affiliate operators to maximize their success rate and payout velocity.

Speed as a Competitive Advantage for Affiliates

Affiliates operating in enterprise environments face a shrinking window of opportunity between initial compromise and defender response. As mean time to detect (MTTD) has improved across mature security operations centers—Mandiant’s 2025 M-Trends report placed median global MTTD at 10 days for ransomware incidents, down from 24 days in 2020—ransomware operators must complete their mission faster. An affiliate who can deploy ransomware and achieve meaningful encryption in under 20 minutes dramatically reduces their exposure to automated containment systems. Intermittent encryption directly addresses this constraint. Groups like Play and Akira have both incorporated partial encryption into their toolkits, with Play ransomware specifically noted by CrowdStrike researchers as using intermittent encryption as a default configuration in samples captured in late 2024 and into 2025.

Easier Decryption Key Management

There is an additional operational benefit for ransomware operators that receives less attention: partial encryption simplifies their decryption infrastructure. Full-file encryption creates larger data commitments when victims pay and operators must provide working decryption tools. Partial encryption means the decryption process is faster, requires less compute on the operator side, and produces a higher rate of successful decryption—which matters because ransomware groups’ long-term business model depends on a reputation for actually delivering decryption keys when paid. A faster, cleaner decryption experience reduces disputes and increases the credibility of future ransom demands.

Target Selection and Industry-Specific Impacts

Intermittent encryption is not uniformly deployed across all victim profiles. Analysis of incident response engagements suggests that sophisticated threat actors apply the technique selectively based on the target’s likely detection capability and the volume of data they need to render inaccessible. Large enterprise targets with mature security operations receive attacks with lower encryption percentages—maximizing speed over thoroughness. Smaller organizations with less sophisticated monitoring may receive higher encryption ratios since the risk of detection before completion is lower.

Healthcare and Operational Technology Environments

Healthcare organizations face particularly acute exposure because their medical imaging systems, electronic health record (EHR) databases, and clinical decision support applications are highly sensitive to even partial data corruption. A DICOM image file with 40% of its blocks corrupted is clinically useless—a radiologist cannot diagnose from a partially corrupted CT scan. The Change Healthcare incident of early 2024, while not solely attributed to intermittent encryption, illustrated how ransomware targeting healthcare data processing infrastructure can cascade into systemic disruption affecting hundreds of downstream providers. Operational technology (OT) environments in manufacturing and utilities are similarly vulnerable: SCADA historian databases and process control configuration files become non-functional with partial corruption, and the industrial systems depending on them may fail in potentially dangerous ways.

Detection and Defense Strategies That Actually Work

Organizations cannot afford to rely exclusively on entropy-based behavioral detection when facing adversaries who have specifically engineered their tools to defeat it. Effective defense against intermittent encryption requires a layered approach that addresses the technique at multiple stages of the attack chain, not just at the point of encryption execution.

File Integrity Monitoring and Chunk-Level Validation

File integrity monitoring (FIM) solutions that operate at the block level—rather than simply monitoring file modification timestamps or whole-file hashes—can detect intermittent encryption by identifying patterns of alternating modified and unmodified data blocks within individual files. Microsoft’s Defender for Endpoint introduced enhanced block-level I/O monitoring in 2025 that specifically flags alternating write patterns as a behavioral indicator of intermittent encryption. Separately, organizations should implement canary files—deliberately monitored files distributed throughout storage systems whose modification triggers immediate automated response regardless of encryption percentage. Security teams at financial institutions have been deploying honeypot file strategies for years, but the key update for 2026 is ensuring these canary files are sized and formatted to be attractive to low-encryption-threshold attacks.

Network-Level Indicators and Backup Architecture

Ransomware encryption events, intermittent or otherwise, are almost always preceded by substantial reconnaissance and lateral movement activity. Network detection and response (NDR) platforms monitoring for large-volume SMB enumeration, unusual Active Directory queries, and Volume Shadow Copy deletion commands (a near-universal ransomware precursor) can interrupt attacks before the encryption payload even executes. For backup architecture, the critical principle is immutability with offline air-gapping. Veeam’s 2025 Data Protection Trends report found that organizations with immutable backup copies recovered from ransomware incidents an average of 23 days faster than those relying on traditional backup snapshots that were accessible to the ransomware process. The backup must survive even if the production environment is fully compromised—and recovery procedures must be tested against scenarios where only 40% of data blocks in each file are corrupted, not just total data loss scenarios.

Regulatory and Compliance Implications

Intermittent encryption creates novel complications for organizations subject to data breach notification regulations. Under GDPR, HIPAA, and state-level privacy laws like the California Privacy Rights Act (CPRA), organizations must assess whether a ransomware incident constitutes a reportable data breach. Full encryption with no exfiltration was historically treated as a confidentiality-intact event by some regulators. Intermittent encryption changes this calculus because unencrypted data blocks remain readable by the ransomware process—and sophisticated threat actors frequently combine intermittent encryption with data exfiltration in what researchers call double-extortion operations. If the malware read file content during its encryption pass, that data may have been exfiltrated even if the encryption percentage was low.

The FTC’s 2025 updated cybersecurity guidance explicitly noted that partial encryption does not diminish the regulatory exposure of affected organizations if personal data was accessed during the attack. CISO and compliance teams should update their incident response playbooks to treat any ransomware event involving intermittent encryption as a presumptive data breach requiring notification assessment, even in the absence of confirmed exfiltration evidence.

Key Takeaways

• Intermittent encryption is now mainstream: Over 40% of enterprise ransomware incidents in recent reporting involve partial encryption techniques, with this figure growing consistently year-over-year as RaaS affiliates adopt it as a default configuration.
• Entropy-based detection is insufficient alone: Traditional behavioral heuristics that flag high-entropy write bursts fail to reliably detect intermittent encryption when encryption ratios fall below 60%, requiring organizations to deploy complementary block-level file integrity monitoring and canary file strategies.
• Speed is the core operational objective: The primary driver of this technique is attack velocity—completing meaningful encryption in under 20 minutes dramatically reduces exposure to automated EDR containment responses and is specifically engineered to beat improving mean time to detect metrics.
• Backup immutability is non-negotiable: Recovery from intermittent encryption requires immutable, air-gapped backups and tested recovery procedures specifically designed for partial file corruption scenarios, not just total data loss events.
• Regulatory exposure does not scale with encryption percentage: Compliance teams must treat ransomware incidents involving any level of intermittent encryption as presumptive breach events requiring notification assessment, since the malware’s file access during execution may constitute unauthorized data processing regardless of encryption completeness.

Conclusion: Adapt Your Detection Architecture Before the Next Incident

Intermittent encryption is not an exotic edge case—it is a mature, widely deployed capability embedded in the most prolific ransomware platforms operating against enterprise targets. The organizations that will suffer the most from this tactic are those whose security programs were designed to detect the ransomware attacks of 2018, not the optimized, detection-aware operations of 2026. The architectural response requires concrete changes: replacing or supplementing entropy-only detection with block-level I/O monitoring, deploying canary file infrastructure across network shares and cloud storage, hardening Active Directory against the reconnaissance that precedes encryption, and stress-testing backup recovery against partial corruption scenarios.

Start with a focused assessment this quarter: audit whether your current EDR platform has specific detection logic for alternating block write patterns, not just aggregate entropy thresholds. If your vendor cannot provide a clear technical answer, that is your most urgent gap. Engage your incident response retainer or internal red team to conduct a tabletop exercise using an intermittent encryption attack scenario. The cost of that exercise is trivially small compared to the 23-day recovery extension that inadequate backup architecture will cost you when—not if—this technique lands in your environment.