Ransomware Countermeasures

A system comprising:

• at least one data processor;
• and
• memory storing instructions which, when executed by the at least one data processor, execute operations comprising:
• initiating execution of an executable and/or DLL in an operating environment;
• continually monitoring characteristics associated with the execution of the executable and/or DLL;
• determining that the executable and/or DLL has one or more characteristics associated with ransomware;
• injecting, based on the determining, at least one simulacra into the operating environment to attempt to entrap ransomware and/or to trigger an anti-detonation protection feature by the ransomware;
• and
• initiating, based on the continual monitoring after injection of the at least one simulacra, one or more ransomware countermeasures.

A non-transitory computer program product storing instructions which, when executed by at least one computing device, result in operations comprising:

• initiating execution of an executable and/or DLL in an operating environment;
• continually monitoring characteristics associated with the execution of the executable and/or DLL;
• determining that the executable has one or more characteristics associated with ransomware;
• injecting, based on the determining, at least one simulacra into the operating environment to attempt to entrap ransomware and/or to trigger an anti-detonation protection feature by the ransomware;
• and
• initiating, based on the continual monitoring after injection of the at least one simulacra, one or more ransomware countermeasures.