Ransomware early warning: how decoy files catch attacks

Ransomware attacks rarely announce themselves. By the time someone notices a ransom note on the screen, hundreds or thousands of files may already be encrypted, and the same thing may be happening on the next machine on the network.

Every ransomware attack has one weakness, though: to do damage, it has to touch your files. Decoy files, often called canary files, turn that weakness into an early warning. This article explains how they work, what they can and can’t do, and what to do the moment one trips.

How ransomware moves through a machine

Most ransomware follows the same pattern once it starts running:

1. It gets in. Usually through a phishing attachment, a malicious download, an exposed remote-access service or an unpatched vulnerability.
2. It looks around. It finds documents, spreadsheets, photos, databases and shared drives worth encrypting.
3. It encrypts, folder by folder. Files are encrypted and typically renamed with a new extension, or replaced and the originals deleted.
4. It leaves a note. Only then does the user see the ransom demand.

Steps 2 and 3 are where you can still act. The earlier you know, the fewer files and machines are affected.

What a canary file is

A canary file is a decoy: a file that looks like ordinary work, placed in folders ransomware is likely to go through. No person has any reason to open, rename or delete it. So when something does, it is a strong signal that an automated process is working its way through your files.

That is the strength of the approach: one touch is enough. Behaviour-based detection usually needs a pattern to build up before it is confident. A canary only needs to be disturbed once, so false alarms are rare and the signal arrives early.

What canaries can and can’t do

Canaries are an early warning, not a shield. It is worth being clear about the limits:

• They detect, they don’t prevent. By the time a canary trips, some files may already be encrypted. The goal is to limit the damage, not to promise none.
• They watch for the decoy being renamed or deleted. That matches how most ransomware handles the files it encrypts. Ransomware that only rewrites files in place, without renaming or deleting them, may not trip a canary.
• Placement matters. Decoys work best in the folders that hold real work: Documents, Desktop and shared project folders.

Canaries, backups and patching: none is enough alone

Ransomware defence works in layers, because each layer fails in a different way. It helps to think about what each one is actually for:

• Patching and closing remote access make it harder for ransomware to get in at all. Most attacks still start with a known, unpatched flaw or an exposed remote-desktop login.
• Antivirus catches known malicious files before or soon after they run. New or repacked ransomware can slip past signatures for a while.
• Canary files tell you quickly when something has got past the first two and started working through your files.
• Backups are how you recover. If they sit on a drive the infected machine can write to, the ransomware can encrypt them as well.

Take any one layer away and the others carry more weight than they were built for. A team with good backups but no early warning finds out late and restores more than it needed to. A team with early warning but no clean backups knows exactly when the attack began, and still can’t get its files back.

What to do the moment a canary trips

1. Isolate the machine. Disconnect it from the network (unplug the cable, turn off Wi-Fi) so the encryption can’t reach shared drives or other computers.
2. Don’t switch it off straight away. Evidence in memory can help an investigation. Disconnect first, then decide with your security team.
3. Check the neighbours. Look for alerts from other machines and for unusual file changes on shared drives.
4. Find the entry point. Check recent email attachments, downloads and remote-access logins on that machine.
5. Restore from clean backups. Only once you know how the attacker got in, so you don’t reinfect the restored system.
6. Record everything. Times, actions and findings. You may need them for insurance, for regulators, or to report the incident to CERT-In.

A 10-minute ransomware readiness check

• Do you have backups that ransomware can’t reach: offline, or immutable?
• Have you restored something from backup in the last three months, to prove it works?
• Are operating systems and common apps (browsers, PDF readers) patched within weeks, not months?
• Is remote access (RDP, remote desktop tools) closed to the internet or protected properly?
• Would you know within minutes if files started changing on a machine, or only when users complain?
• Does everyone know who to call and what to unplug?

If any answer is “no” or “not sure”, start there.

How GarudView helps

GarudView places decoy canary files on the endpoints it manages. If a decoy is renamed or deleted, it raises a high-confidence alert straight away, by email, Telegram or WhatsApp, and opens an incident so your team has one place to track the response. The same agent also runs antivirus scans, behavioural detections and patch management, which cover the other parts of the checklist above. It all runs inside your own infrastructure.