Intermittent encryption, also called partial encryption, is a technique where ransomware encrypts only portions of each file rather than the whole thing. Skipping chunks makes the encryptor dramatically faster, which shortens the window in which defenders can intervene, and it leaves each file statistically similar enough to the original that some detection tools miss it. First seen prominently around 2021 in LockFile, it has since become a selling point that operators advertise to affiliates, and it is now standard in families like LockBit and Qilin.
How does partial encryption work?
A traditional ransomware encryptor reads a file end to end and encrypts every byte. Intermittent encryption instead encrypts fixed-size blocks and skips the gaps between them, following a pattern the operator chooses: encrypt the first few megabytes only, or encrypt one block and skip the next, or step through the file at intervals. The file is still unusable to the victim, because the encrypted regions corrupt the data and only the attacker holds the key. But the machine did a fraction of the cryptographic work, which is the entire point. Less work per file means more files locked per minute.
Why do ransomware crews want it?
Speed is survival for an encryptor. The longer encryption takes, the more time an EDR agent, an analyst, or an automated response has to notice mass file changes and kill the process. By cutting the work per file, intermittent encryption compresses the whole encryption phase, sometimes turning an hours-long job into minutes across a large fileserver. There is a second benefit. Because a partially encrypted file still contains stretches of original data, statistical measures like entropy, which detection tools use to spot encryption, can read closer to normal. A file that is only 20 percent encrypted looks less obviously scrambled than one that is fully locked, which helps the attack slip past entropy-based alerts.
What is the trade-off for the attacker?
Partial encryption is a balance, and the operators tune it. Encrypt too little of a file and a victim might recover usable data from the unencrypted portions, weakening the extortion leverage. Encrypt too much and you lose the speed and stealth advantage that motivated the technique. This is why modern families make the pattern configurable, letting affiliates choose how aggressive to be based on file type and target. Some, like Qilin, pair intermittent modes with faster ciphers such as AES-256 in counter mode using hardware acceleration, squeezing speed from both the algorithm and the amount of data processed. The design goal is always the same: ruin the file with the least work that still guarantees ruin.
How do you detect and defend against it?
Because entropy alone is weaker against partial encryption, defenders lean on behaviour. The tell of any encryptor is not what a single file looks like but the pattern of activity: a process rapidly opening, reading and rewriting large numbers of files across directories in a short span. Modern EDR watches for that mass-modification behaviour rather than trusting file entropy, and canary files that trigger an alert the moment they are touched give early warning regardless of how much of them gets encrypted. Everything else is the familiar ransomware playbook, because intermittent encryption is only the final stage. Stop the intrusion earlier and the encryption speed never matters. Keep offline, tested backups so recovery does not depend on the attacker, and use EDR that detects encryption behaviour rather than static signatures.
Frequently asked questions
What is intermittent encryption in ransomware?
It is a technique where ransomware encrypts only parts of each file, skipping blocks, instead of encrypting the whole file. This makes the encryptor much faster and helps it evade some entropy-based detection, while still rendering files unusable.
Does partial encryption make files recoverable?
Usually not in any useful way. Although parts of the file remain unencrypted, the encrypted regions corrupt the data, and only the attacker holds the key. Operators tune how much to encrypt precisely to guarantee the file is ruined.
Which ransomware groups use intermittent encryption?
It appeared prominently in LockFile around 2021 and has since spread to families including LockBit, BlackCat, Qilin and others. Many operators now advertise configurable partial-encryption modes as a feature to attract affiliates.
Why does intermittent encryption evade detection?
Encrypting only part of a file leaves stretches of original data, so statistical measures like entropy read closer to normal than a fully encrypted file. Detection that relies on file entropy alone is therefore weaker against it, which is why behaviour-based detection matters more.
How do you detect intermittent encryption?
Focus on behaviour rather than individual files. Watch for a process rapidly reading and rewriting many files across directories, and deploy canary files that alert when touched. Behaviour-based EDR catches the mass-modification pattern regardless of how much of each file is encrypted.
Sources and further reading
- Intermittent File Encryption in Ransomware: Measurement, Modeling, and Detection (arXiv, peer research)
- SentinelOne Labs — Ransomware Developers Turn to Intermittent Encryption (primary analysis)
- Sophos — LockFile uses intermittent encryption (original discovery)
- Ransomnews — Best business ransomware protection