What Happened
RIED is a ransomware variant from the Makop family discovered in September 2026. Like other Makop strains, it encrypts files on infected Windows systems, appends a distinctive extension (in this case, the victim’s unique ID, the attacker’s email address, and “.RIED”), and drops a ransom note demanding payment.
On test systems, a file named “1.jpg” became “1.jpg.[2AF20FA3].[[email protected]].RIED” after encryption. The attackers left a note titled “+README-WARNING+.txt” offering to decrypt two small files for free as proof of capability, then directing victims to contact them via email.
The note also warns victims not to use antivirus software or third-party recovery tools, claiming such actions could “damage the private key” and make recovery impossible. That’s not a bluff. Modern ransomware uses strong encryption. Once your files are locked, no antivirus signature will decrypt them. Your realistic options are: pay the ransom and hope the scumbags follow through (they often don’t), or restore from a backup that wasn’t connected during the attack.
The article correctly points out that decryption without the attacker’s cooperation is generally impossible unless the ransomware has serious coding flaws that researchers can exploit. RIED doesn’t appear to have those flaws.
Why Traditional Defenses Fail
Antivirus tools work by recognizing threats they’ve already seen. A researcher discovers a new ransomware variant, analyzes it, creates a signature, pushes an update, and your antivirus learns to block it. That process takes time — hours or days. The window between a new ransomware release and when your antivirus can detect it is exactly when attacks happen.
RIED was flagged on VirusTotal and analyzed by multiple antivirus vendors. But there was a window — likely hours, possibly longer — when it was completely unknown. During that window, signature-based detection did nothing.
Even after signatures exist, they only work if your systems have received the update. Systems that are offline, air-gapped, or running on delayed update schedules remain vulnerable.
How FileSure Would Have Prevented It
FileSure Defend doesn’t try to recognize ransomware. It operates at the Windows kernel level via a filter driver and intercepts file operations before they complete. You define what’s allowed to happen to your files. Everything else is blocked.
Ransomware has to write encrypted versions of your files to disk. That’s not optional — it’s how file encryption works. That write operation happens at the file system level, and FileSure sits exactly there.
Here’s a specific rule configuration that would have stopped RIED:
Operation: Block Write, Create
File Name Filter: * (all files)
Program Name Filter: NOT (explorer.exe, winword.exe, excel.exe, [your authorized applications])
Drive Type: Fixed, Removable
Translation: only programs you explicitly authorize can write or create files on local and removable drives. Everything else — including ransomware payloads that just landed on the system — cannot.
When RIED tries to write the encrypted version of “1.jpg” to disk, FileSure intercepts the write operation, checks the program attempting it against the authorized list, finds no match, and blocks the operation. The ransomware payload might have executed, but it never touched your files.
No signature update required. No waiting for a vendor to analyze the threat. No window of vulnerability while the security industry catches up.
This works on RIED. It works on the next Makop variant. It works on ransomware families that don’t exist yet. The mechanism is the same because the requirement is the same: ransomware must write to disk to encrypt files.
The Upstream Advantage
The article mentions that RIED is often distributed via phishing emails with malicious attachments — Office documents with macros, executables, ZIP archives. When a normal person opens one of those attachments, the malicious payload writes itself to disk before it executes.
That’s another file write operation FileSure can block. A rule preventing email clients and browsers from writing executable files stops the payload from ever landing. No payload on disk means no execution, no encryption, no ransom note.
Most organizations run FileSure alongside their existing antivirus. They’re complementary. Antivirus handles known threats. FileSure handles everything else — the zero-days, the variants that just appeared this morning, the stuff that slips past signature-based detection.
FileSure also runs on legacy Windows systems — the kind that modern endpoint tools won’t install on. If you have medical equipment, industrial controllers, or specialized software locked to an older OS version, FileSure still protects them.
You can see it working in under three minutes. Install FileSure, open a Word document, check the console — the file operation is already logged. Then try our test file that mimics ransomware behavior. Watch it get blocked in real time.
That’s the whole demo. It works exactly like that, every time.
Start your free 21-day trial at bystorm.com — 1 server, 10 workstations, fully functional, no credit card required.
Source: RIED Ransomware – Decryption, removal, and lost files recovery
Category: Ransomware
Tags: ried ransomware, makop ransomware, file encryption, kernel filter driver, zero-day protection, file system security, ransomware prevention
