File encryption (T -02:00)

Once the backup files are deleted, the malware performs a secure key exchange with the command and control server (C2). This establishes the encryption keys which will be used in the local system.

Go Back