The cybersecurity landscape has reached a dangerous turning point. Recent threat intelligence data reveals that ransomware groups are operating at an unprecedented scale, shattering previous records and leaving standard enterprise defenses struggling to keep pace.

Since the beginning of 2026, a staggering 4,700 victims have been publicly posted on ransomware leak sites. This is not just a minor fluctuation; it represents a record-breaking 16 percent surge compared to the exact same period last year. Even more alarming is the longer-term trajectory, which shows an increase of almost 65 percent compared to the same timeframe in 2024. The crisis intensified drastically in June 2026 alone, with 708 new victims exposed on ransomware websites in a single month.

These numbers prove that traditional security measures are failing to stop modern attackers. Traditional Endpoint Detection and Response (EDR) systems rely on recognizing known malware signatures or spotting malicious behavior after it has already started. Unfortunately, by the time an alert is generated, the encryption process is often well underway, resulting in costly downtime, data theft, and catastrophic operational disruption.

MITRE has resolved this by officially splitting Defense Evasion into two separate tactics: Stealth and Defense Impairment.

At Deceptive Bytes, we recognize that this update is a validation of how modern endpoints must be defended. Our Active Ransomware Prevention platform is built to stop threats right where they try to hide, which is within this newly defined Stealth level of the attack.

The Meaning: What is the “Stealth” Tactic?

The reclassification introduces a clearer lens based on adversary intent rather than just behavior.

• Stealth (retaining ID TA0005): This tactic covers techniques where adversaries hide malicious activity within legitimate behavior. The enterprise security defenses are still fully operational, but the attacker is actively trying to fool them. They operate below the detection threshold by blending in, using techniques like masquerading, obfuscating files, or system binary proxy execution.
• Defense Impairment (new ID TA0112): This tactic applies when an attacker actively breaks, degrades, or disables security controls. This includes killing an EDR agent, tampering with logs, or turning off antivirus software.

To put it simply, Stealth is about hiding from security defenses, while Defense Impairment is about breaking them.

The Reason Behind the Shift

The primary driver behind this structural change was the need to distinguish between two fundamentally different adversary objectives that require different defensive responses. Under the former Defense Evasion tactic, techniques designed to conceal malicious activity were grouped alongside techniques that actively disabled, degraded, or tampered with security controls. As a result, alerts associated with the tactic could represent vastly different levels of risk and urgency.

By separating these behaviors into Stealth and Defense Impairment, defenders gain greater operational clarity and can prioritize response efforts more effectively. A Defense Impairment alert indicates that an attacker may be compromising the integrity or effectiveness of security controls, often warranting immediate investigation and containment. A Stealth alert, in contrast, signals an attempt to blend malicious activity into legitimate user or system behavior, requiring deeper analysis, threat hunting, and correlation across multiple data sources. This distinction enables more accurate triage, clearer reporting, and more targeted detection and response workflows.

How Deceptive Bytes Stops Attackers at the Stealth Level

Advanced ransomware and malware variants rarely start by loudly breaking security tools. Instead, they begin their lifecycle in the Stealth phase. They check their environment, look for indicators of analysis or sandboxes, and attempt to blend in silently to execute their payloads without triggering traditional behavioral rules.

This is exactly where Deceptive Bytes’ Active Ransomware Prevention platform intervenes.

Instead of relying on signature matching or reactive detection rules that Stealth techniques are designed to bypass, our solution employs an adaptive deception environment directly inside the endpoint. When malware attempts Stealth techniques, such as verifying system components or checking for virtual environments, our platform responds with dynamic, false information.

By making the endpoint look like an active malware analysis sandbox or an unfavorable environment, we turn the attacker’s own evasive logic against them. The ransomware pauses or self-terminates to avoid detection, stopping the threat before it can transition into data encryption or lateral movement.

What to Expect in the Future

The introduction of the Stealth tactic marks a broader trend toward validating security control resilience. In the future, we expect threat actors to develop even more sophisticated methods of blending into regular business workflows, especially by abusing legitimate administration tools and living-off-the-land techniques.

Security teams must update their internal playbooks, SIEM rules, and reporting structures to align with MITRE v19. Relying solely on visibility is no longer enough. Organizations must deploy proactive security models that actively disrupt an adversary’s decision-making process while they are operating in the Stealth phase.

By understanding the distinction between an attacker hiding and an attacker destroying, security teams can build a more resilient posture, backed by proactive prevention platforms that stop modern ransomware in its tracks.

Operations “Epic Fury” (U.S.) and “Lion’s Roar” (Israel) are not just feats of firepower and precision. They are masterclasses in strategic deception. In both cases, the decision makers did not just plan strikes. They planned misperceptions, false signals, and carefully staged appearances so that Iran’s early warning systems and intelligence machinery would see the “wrong” picture until it was too late. Those same deception principles, masking true intent, manipulating expectations, and luring adversaries into predictable patterns, sit at the heart of modern cyber deception, including Deceptive Bytes’ endpoint centric Active Deception platform.

How Israel deceived Iran before “Lion’s Roar”

Long before the first missile lit up the skies over Iran, the IDF (Israel Defense Forces)  and its allies ran a campaign of strategic and operational deception. Senior officials deliberately maintained a routine public and satellite visible image of normalcy, even as forces prepared for a massive strike. One vivid example is that on the eve of the operation, the IDF Chief of Staff and his aides returned late from what looked like an ordinary family dinner, deliberately using private or non official cars so that the official vehicles did not cluster at the Kirya headquarters. This meant that from satellite imagery Iran could see, the Ministry of Defense appeared as an empty, routine night compound, not a hub of final hour war planning.

Beyond personal level tricks, Israel and the U.S. ran a broader narrative deception. Leaks about “upcoming family events,” “routine diplomatic talks,” and “vacation plans” were designed to lower Iran’s pulse of alert. By feeding Tehran a story of political calm and domestic preoccupations, Israel helped delay the perception of an imminent attack, compressing the time Iran had to disperse forces or harden command centers. At the same time, behind that curtain, hypersonic and precision guided munitions were being positioned, electronic warfare suites tuned, and air wings readied, all while the adversary’s sensors were still tuned to the “normal” baseline.

Tactical deception during “Epic Fury” and “Lion’s Roar”

The deception did not end with pre-strike misdirection. “Epic Fury” and “Lion’s Roar” leaned heavily on temporal deception and expectation bias. Iran’s planners expected a nighttime attack, but the U.S. and Israel struck in broad daylight. That mismatch between expectation and reality degraded Iran’s reaction cycle, because its procedures, alert shifts, and command routines were optimized for a night time scenario. Radar and command centers that were “on holiday” mentally suddenly had to manage a major inbound raid, without the cover of darkness.

Another layer was the use of advanced reconnaissance and sensor manipulation. Reporting on earlier Israel-led operations suggests that Iranian radar and surveillance systems were flooded with decoy drones, spoofed signatures, or ambiguous traffic so that operators could not distinguish between “routine” and “threatening” patterns. That same concept, confusing the enemy’s sensors with false or noisy signals, is exactly what cyber deception tools do when they scatter fake credentials, honey paths, and phantom endpoints across a network.

The deployment of U.S. F 22 Raptors to Israel in the days leading up to the operations also served a dual purpose: overt deterrence and covert camouflage. Publicly, the arrival of these advanced stealth fighters signaled U.S. readiness and commitment, which could provoke Iran into a predictable posture. Privately, it also created a new “normal” baseline for Iranian SIGINT and satellite watchers. More jets, more noise, more activity. Once that baseline was established, the actual strike packages could be disguised inside the expanded air traffic pattern, making it harder for Iran to distinguish rehearsal from real time execution.

From battlefield deception to cyber deception

On the battlefield, deception is about violation of expectation. Making the enemy see a calm sky while the fleet is outbound, or a quiet headquarters while the command team is secretly in motion. In cybersecurity, the same playbook applies, only the battlefield is the memory and file system of an endpoint.

Traditional defenses such as EDR and gateways wait for an attacker to manifest malicious behavior, unusual process behavior, encrypted exfiltration, or registry changes, after the attacker is already inside. Cyber deception, by contrast, assumes the attacker will probe, enumerate, and move laterally. It simply ensures that the first things they see are bait rather than real assets. Deceptive Bytes’ Active Deception, for example, weaves deceptive artifacts, fake credentials, decoy services, and illusory lateral paths, into the live memory of every endpoint. A legitimate user does not encounter these traps. Only an intruder who is actively exploring the system will.

Why today’s “Epic Fury” style threats need endpoint deception

Endpoint deception with Deceptive Bytes is like turning each endpoint into a fortress that appears heavily guarded so that malware’s evasion and reconnaissance techniques immediately reveal themselves. Instead of hiding the real assets, the environment is designed to look so secure and instrumented that any suspicious behavior such as credential hunting, lateral movement probing, or memory scanning trips built in traps and triggers early detection or termination before the malware can settle in.

In the context of “Epic Fury” and “Lion’s Roar,” the IDF and U.S. forces did not just react to missiles in the sky. They sought to degrade the adversary’s ability to launch in the first place. Cyber deception aims for the same goal. Instead of waiting for a ransomware payload to detonate, it seeks to stop the attacker in the reconnaissance and lateral movement phase, when the cost of interception is lowest and the impact on the business is still near zero.

Operational deception in practice: Deceptive Bytes as “Kirya camouflage” for the endpoint

If you think of your enterprise network as the Kirya headquarters, every endpoint is a potential window into that HQ. Cyber deception tools like Deceptive Bytes are the “non official cars” of cybersecurity. They make the environment look normal to the casual observer while hiding the real command structure and high value assets.

By scattering realistic looking decoys across users, servers, and cloud workloads, Deceptive Bytes creates a scenario where any attacker that persists beyond the perimeter will eventually, and intentionally, touch a trap. That trap signal is not a guess. It is a high fidelity indication of an active adversary, which shifts the security posture from reactive logging to proactive engagement and containment.

In short, “Epic Fury” and “Lion’s Roar” show that modern warfare is as much about misperception as it is about missiles. In cybersecurity, the equivalent is Active Deception. Turning the attacker’s assumptions, routines, and search patterns against them, so that the first move they make inside your network is also the first move you see.

Deceptive Bytes continues to lead the charge in proactive endpoint defense with the launch of three groundbreaking protection engines. These additions supercharge the platform’s ability to outsmart attackers. They deliver tailored protection, browser safeguards, and app-level controls that keep threats at bay across diverse environments.

Customized Protection Engine: Precision Deception at Scale

The star of the update is the Customized Protection engine. It empowers security teams to craft environment-specific defenses like never before. Hide your most critical data and assets while deploying hyper-realistic fake files, folders, processes, and more. All of this is fully customized to your unique environment.

• Cross-platform mastery: Seamless support for Windows, Linux, and macOS
• OS-native flexibility: Leverage files, folders, processes, and other artifacts (OS-dependent)
• Attacker frustration maximized: Turn every endpoint into a maze of misleading traps that expose tactics and waste precious time

This engine transforms passive endpoints into active traps. It gives you the upper hand against ransomware and advanced persistent threats.

Browser Protection Engine: Lock Down Risky Surfing

Browsers remain a prime attack vector, but no longer. The new Browser Protection engine lets administrators enforce granular security and AI policies in Chrome, Microsoft Edge, and Firefox.

Stop risky behaviors in their tracks before phishing, drive-by downloads, or malicious extensions can escalate into full breaches. With intuitive policy controls, maintain productivity while slashing browser-borne vulnerabilities.

Office Apps Protection Engine: Secure Everyday Workflows

Document-based attacks hit hard and often. The Office Apps Protection engine closes this gap by applying robust security and AI policies to Microsoft Office and Adobe Reader (currently for Windows only).

• Neutralize macros, embedded threats, and untrusted content
• Policy-driven safeguards tailored to real-world usage
• Zero disruption to daily operations

Protect where users spend most of their time, without slowing down your team.

Policy Powerhouse: Simplified Management at Scale

The Browser and Office Apps Protection engines take policy management to the next level. They simplify creation and deployment of consistent security rules across thousands of endpoints while enhancing effectiveness through intelligent, adaptive controls. Scale protection effortlessly without complexity, ensuring uniform defense and rapid response organization-wide.

Why These Enhancements Change the Game

In an era of relentless ransomware evolution and sophisticated adversaries, Deceptive Bytes stands out with lightweight, prevention-first defense that adapts to your needs. These new engines deliver:

Deploy faster, scale effortlessly, and stay steps ahead. Ready to fortify your endpoints? 

Contact Deceptive Bytes today to experience the future of active cyber defense.

Recently we on reported on SparkOnSoft which our Active Ransomware Prevention platform prevented in multiple customers’ environments worldwide.
Since then we’ve noticed that not only the campaign continues, it also mutates as new samples use another PDF application signed by a different certificate

Basic Information

The new payload is a PDF application called Proton PDF though the file name starts with ClearEdit and the file was signed with an Extended Validation certificate by Hawk Integrated Inc issued by Sectigo
Interestingly, the payload is a NSIS installer while SparkOnSoft samples, including new ones, still use InnoSetup to create the installers
The new payload is identified as part of the SparkOnSoft campaign according to VirusTotal (see IOCs below)
In addition, since our last post our prevention platform identified more samples which were still being downloaded from sparkonsoft[.]com and are still signed by Mainstay Crypto LLC issued by Microsoft

IOCs

• SHA2: 686d018c86c03165925ebd3773c622f182c93f54b98db9616bae86f5e8684e4c (Proton)
• SHA2: 91e4f66fb2af51fa3b2e0463c8c140e628d5d057cadde3f7d4d4bcb991289a38 (Spark)
• SHA2: 73dbd23bb38472c1a9a3b0fb6f3ed5c9c272204e01de4bd35fed6034bf3c463b (Spark)
• SHA2: 4fa777e1392037fde13b8e93b7d69427926fca5000b816f562e829c9246f46c9 (Spark)
• Compromising websites: hxxps://pdfproton[.]com and hxxps://[*.]getpdfproton[.]com
• Compromised AWS S3: hxxps://internalcomponentspdf[.]s3.us-east-1.amazonaws.com (Spark)

In the past week we’ve seen a surge with new variants of a malware which our Active Ransomware Prevention platform prevented for multiple customers worldwide.
The common thread between all the attacks is the source, all are installations of a supposed PDF application called PDF SparkOnSoft.

Entry Point

In all cases the files were download from online, suggesting the scammers placed malicious ads and/or poisoned chat-based AIs to appear legitimate.

Basic Information

The file is a small installer written with InnoSetup as it contains details related to a PDF app.
The first payload our solution prevented was signed with an Extended Validation certificate by Mainstay Crypto LLC and issued by Sectigo.
The other installers were signed by the same vendor, however, this time the certificate was issued by Microsoft.

The file’s properties indicate that it’s a PDF software and the publisher as Mainstay Crypto.
The version remains 1.0.0.0 between samples as the attackers likely didn’t modify the InnoSetup installer used for building the malicious payload.

Execution

When executed, all the samples first checks if they’re running under WINE, a Windows compatibility-layer that allows Windows PE executables to run under Linux, macOS and other non-Windows operating systems, they do so by checking if the function wine_get_version exists in ntdll.dll, Windows’ Native API dynamic library, as this function only exists in WINE environments
(Microsoft’s ntdll file never had this exported function).

Prevention

Since the above execution is a clear indication of a malicious activity as attackers check for WINE to identify being investigated by security services utilizing WINE for malware analysis, the Deceptive Bytes platform immediately stopped the attack and all the malware samples failed to infect our customers’ machines.

IOCs

• SHA2: 415b6d1bb78cb74a468b29e7af09e885999cfcabf2c413f3bf533c2191d4e626
• SHA2: 4617e321a142d4ed35d71d3532be764deec63dafe8bdec010a8ace4ea5bba5b4
• SHA2: 00f0338e7caa630d10347a5bebed83bb4c11ebce34f4470a213f93828a66addf
• SHA2: 717c2728b957a7faecb7d1ac057bb03053f6397bbc369092c493daf6d45dc67c
• SHA2: c1f686082eb39db8cd58f36247e894b22c95d10672e9d50380b824ab9f2e2f46 (installer payload)
• Imphash: efd455830ba918de67076b7c65d86586
• Certificates: Mainstay Crypto LLC
  • Issuer #1: Sectigo Public Code Signing CA EV R36 (now revoked)
  • Issuer #2: Microsoft ID Verified CS EOC CA 02 (still valid)
• Compromising website: hxxps://sparkonsoft[.]com
• Compromised AWS S3: hxxps://pdfsparkcomponent[.]s3.us-east-2.amazonaws.com

Understanding the Cyber War and the Role of Prevention

The cyber war is a continuous conflict between attackers who seek to exploit vulnerabilities and defenders who aim to safeguard digital assets. Ransomware attacks have grown increasingly sophisticated, using advanced tactics to bypass traditional security measures. Preventative solutions act as a frontline defense, not by merely reacting to threats but by proactively disrupting the attacker’s reconnaissance and execution phases.

One powerful approach is the use of environment distortion techniques. These solutions create controlled, deceptive environments that make it challenging for ransomware to accurately identify key systems or data to target. By providing false indicators about the environment, attackers are misled to terminate their malicious activities, to ultimately failing in deploying their encryption or data exfiltration capabilities.

Distorting Ransomware Perception: A Strategic Advantage

Distortion of perception in cybersecurity means deliberately manipulating how attackers perceive the environment. Ransomware operators rely heavily on accurate intelligence and reconnaissance to identify critical assets. By skewing this intelligence through deception technologies to deter ransomware from operating, defenders gain a strategic advantage.

• Creating False Trails: Providing deceptive signals that confuse automated attack tools and human adversaries alike.
• Dynamic Environment Changes: Continuously altering how the endpoint is perceived to the ransomware and preventing attackers from establishing a reliable map of the target environment.
• Security Manipulation: Creating false indication of various security tools within the environment to confuse ransomware from the real security capabilities available to the organizations, and protecting the use of existing tools from exploitation by threat actors.

This approach not only prevents successful infiltration but also generates valuable intelligence about attacker behavior and tactics. Organizations can then improve their defenses based on real-world attack scenarios, creating a feedback loop that strengthens security over time.

Conclusion

Winning the cyber war against ransomware requires more than reactive defenses – it demands proactive, preventative solutions that distort attackers’ perception of the environment. By leveraging deception technologies and environment distortion, organizations can disrupt ransomware campaigns early, minimize risk, and gain critical intelligence. Ultimately, these strategies are essential for building resilient cyber defenses in an ever-evolving threat landscape.

The Art of Deception in Operation Midnight Hammer

The operation’s planning was a masterclass in strategic deception. As the main B-2 bomber strike group quietly flew east toward Iran, a separate group of bombers headed toward the Pacific, serving as a decoy to mislead Iranian intelligence about the true direction of the attack. This ruse, known only to a handful of planners, was complemented by minimal communications and the use of advanced stealth technology. Just before entering Iranian airspace, the U.S. also launched Tomahawk cruise missiles from a submarine, further confusing Iranian radar operators and diverting attention from the main aerial assault.

The Trump administration’s role in this deception was pivotal. In the days leading up to the strike, President Trump publicly projected an image of indecision, stating that he would wait two weeks before making any determination about bombing Iran—a statement designed to lull both Iranian leaders and the international community into a false sense of security. Behind the scenes, however, Trump had already resolved to carry out the attack, and military preparations were well underway. This political misdirection was reinforced by Trump’s public lunch with a known opponent of military action, further fueling speculation that he might hold off. In reality, less than 30 hours after these statements, he authorized the assault. This deliberate confusion bought precious time for military planners and ensured the element of surprise, allowing the U.S. to execute a complex and highly secretive operation that caught Iran—and much of the world—completely off guard.

Endpoint Deception: The Cybersecurity Parallel

This military deception mirrors the proactive strategies employed in cybersecurity, particularly by companies like Deceptive Bytes. However, while traditional cyber deception often relies on decoys or honeypots, Deceptive Bytes takes a more sophisticated approach: endpoint deception. Rather than setting traps, their technology dynamically creates false information about the actual environment on endpoints. This distorts the perception of ransomware and other malicious actors, confusing them about the true nature of the system they are targeting.

By altering the environment’s apparent characteristics in real time, Deceptive Bytes prevents attackers from accurately mapping or exploiting the system. This not only stops malware and ransomware before they can execute but also reduces the attack surface and improves overall security posture. Attackers are forced to waste resources and often reveal their presence early in the attack chain, giving defenders a critical advantage.

Deception as a Force Multiplier

Just as Operation Midnight Hammer’s decoys and misdirection enabled the U.S. to strike with minimal resistance, Deceptive Bytes’ endpoint deception tactics force cyber attackers to question every move, undermining their confidence and effectiveness. Both strategies demonstrate that in modern warfare—whether kinetic or digital—deception is a powerful tool for gaining the upper hand, neutralizing threats, and protecting critical assets. In a world where the element of surprise can mean the difference between victory and defeat, mastering the art of deception remains as vital as ever.

The Importance of Preemptive Cyber Defense

As cyber threats continue to evolve, organizations must adopt a proactive stance to safeguard their digital assets. Gartner’s report outlines several top use cases in preemptive cyber defense that can significantly enhance security postures:

• Advanced Cyber Deception: Utilizing deceptive tactics to mislead attackers and protect sensitive information.
• Automated Moving Target Defense: This approach involves continuously changing the environment to confuse attackers, making it difficult for them to establish a foothold.
• Predictive Threat Intelligence: Leveraging data analytics to anticipate potential threats before they manifest.
• Network Threat Detection and Observability: Enhancing visibility into network activities to identify and respond to threats in real-time.
• Threat Simulation and Automated Exposure Management: Testing defenses against simulated attacks to identify vulnerabilities.

Incorporating these strategies can lead organizations to a more robust security framework.

How Deceptive Bytes Enhances Cyber Resilience

Deceptive Bytes’ Active Endpoint Deception solution is designed to improve an organization’s prevention capabilities. By creating dynamic and deceptive information, this solution interferes with attackers’ attempts to recon the environment, effectively deterring them from executing malicious activities. Key features of this platform include:

• Real-time Threat Prevention: The system operates dynamically, deceiving threats as they evolve.
• High Prevention Rates: It boasts very high prevention rates against unknown malware and ransomware by changing the perceived environment to deter their malicious execution.
• Lightweight Deployment: The solution is easy to deploy, requiring minimal resources (less than 0.01% CPU usage, less than 20MB of RAM) and can be operational within seconds.
• Low False Positive Rate: This ensures that security teams can focus on genuine threats without being overwhelmed by alerts.

By integrating Deceptive Bytes into their security architecture, organizations can shift from a reactive approach—where they respond after an attack—to a proactive stance that prevents attacks before they occur.

Conclusion

As highlighted in Gartner’s research, the need for preemptive cyber defense solutions is more critical than ever. Deceptive Bytes stands out as a formidable option for organizations looking to enhance their cybersecurity posture. By adopting advanced techniques such as endpoint deception, companies can not only protect their assets but also improve their overall resilience against the ever-evolving landscape of cyber threats.

Disclaimer: Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.