Malware and ransomware protection
Known-malware scans, automatic protection and fake-app checks on the phone; ransomware warnings on servers.
- Available
- 06
- Limited
- 02
- Not released
- 02
- Coming
- 02
How the attack works
Ransomware encrypts files and demands payment for the key. Modern operations also copy data first and threaten to publish it, and they look for backups to destroy before they encrypt, because a working restore is what makes the ransom worthless.
- STAGE 01
Entry
A phishing attachment, a stolen remote-access password, an unpatched internet-facing service or a malicious download.
- STAGE 02
Preparation
Privileges are raised, security tools disabled, and backups and shadow copies located and deleted.
- STAGE 03
Encryption
Many files are rewritten in a short burst, often starting with shared folders.
- STAGE 04
Extortion
A ransom note, sometimes with a threat to leak the copied data.
- Small offices with shared drives and no tested backups
- Servers with internet-facing remote access
- Home computers with years of irreplaceable photos
A common pattern: attackers sign in through an exposed remote-desktop or SSH service with a guessed or bought password, spend time quietly disabling backups, and start encryption outside working hours so nobody notices the burst until morning.
Ransomware encrypts many files quickly. What matters is noticing early and being able to get files back.
Sensor, rule, evidence, action
Each step carries its own state. A step that is not built is shown as coming, not skipped.
File-change counter
The desktop app watches folders you approve and counts changes, including deletions.
Not releasedDesktop (unsigned pre-release)Burst rule BIDUA-RANSOM-0001
Exactly 20 changes inside 10 seconds raises a warning. Mapped to ATT&CK T1486. Confidence is capped at 0.8 because it is a heuristic.
Not releasedDesktop (unsigned pre-release)Counts with a stated window
The detection carries the count and window it saw, so you can read why it fired.
Not releasedWarn; quarantine is yours
The policy gate caps every automatic action at WARN. Quarantine is user-initiated, encrypted and reversible. On servers, ClamAV scans run on request.
LimitedDesktop + server agent
Watch for a burst of file changes in folders you choose (desktop rule: 20 changes in 10 seconds raises a warning).
Quarantine is reversible: files are kept in an encrypted, integrity-checked container and restored only if the check passes.
The desktop app warns; it does not delete or kill anything on its own (policy ceiling: WARN).
What works today, and what is coming
What works today
08In production or in the current download.
- Known Android malware list on the phoneAvailable
A signed list of malware fingerprints kept on the phone and refreshed by small updates; the current count and sources are on the Android protection page, read live from the hub.
Android app 4.50
- Quick scan and full phone scanAvailable
Compare every app and installer with the list, find fake brand apps, hidden installers and apps from outside a store, and give one result with what to do. The scan sends nothing anywhere.
Android app 4.50
- Installers inside a .zip or .rarAvailable
Archives are read without unpacking; not covered: 7z, tar, nested and password-protected archives.
Android app 4.50
- Automatic protectionAvailable
A new app, a new download in Downloads, WhatsApp or Telegram, and a re-check of installed apps every 6 hours; a notification if something is wrong. An APK that arrives raises a warning even when no signature matches.
Android app 4.50
- Quarantine for installer files on the phoneAvailable
Move an installer to a locked folder inside the app, restore it or delete it for good.
Android app 4.50
- Ransomware detection on servers (detect only)Available
Decoy files and a ransom-note check on Linux and macOS servers; it raises an alert and does not stop anything.
Server agent (Linux, macOS)
- On-demand malware scan on serversLimited
ClamAV quick or full scan, run from the console. Needs ClamAV on the server.
Server agent (Linux)
- Ransomware activity view in the portalLimited
Exists, but desktop quarantine is local to the device, so the portal cannot list it.
Web portal
Built, not yet released
02The code exists and is tested in the repository; it has not shipped to users.
- Rapid file-change warningNot released
Burst detection on monitored folders.
Sentinel desktop (unsigned pre-release)
- Encrypted quarantine with verified restoreNot released
Tampered or wrong-key containers are refused, not restored.
Sentinel desktop (unsigned pre-release)
Coming
02Not built yet. Nothing on this list runs today.
- Protected folders and automatic rollbackComing
Blocking writes to chosen folders and rolling back changes.
- Detecting a sample nobody has reported yetComing
The list matches known files only. Wording and permission patterns are checked, but there is no machine learning and no zero-day detection.
5 attack families map to this capability
Copied row by row from our engineering register. A family counts as detected only when a rule, a sensor that feeds it and a test that makes it fire all exist.
Feature states above and register statuses measure different things: a feature can be built while the family it addresses stays unobserved, because the register counts sensors and rules, not screens.
| # | Attack family | Status | What the register says |
|---|---|---|---|
| 001 | Malware | Partial | On-demand engines only: ClamAV on Linux servers, Defender on the Windows agent, an APK hash lookup on Android. Results do not reach the correlation engine and there is no real-time desktop engine.Production + repository |
| 002 | Ransomware | Partial | Desktop rule warns when 20 files change within 10 seconds in folders you approved. Repository only; the rule is tested with a synthetic flag, the real counter is not.Repository only |
| 127 | Recovery / Restore Sabotage | Partial | The desktop quarantine refuses to restore a container whose header or encryption check fails, and raises a high-severity signal. Tested; repository only.Repository only |
| 080 | Wiper / Destructive Malware | Observable | The desktop burst counter also counts deletions in approved folders, but no wiper-specific rule exists. Repository only.Repository only |
| 077 | Backup Destruction | No sensor | No backup-integrity monitoring; no restore drill (CURRENT_STATUS P10)Nothing runs |
What runs where, and what never leaves
Classification happens on the device before anything is queued. Cloud reporting is off by default on consumer devices and turning it off also stops events already queued.
Runs on the device
- Folder watch and the file-change counter
- Quarantined files, in an encrypted container with a device-held key
- The recovery journal of every quarantine and restore
May reach the cloud
- Only with cloud reporting on: detection category, severity, rule id, confidence and a redacted file name
- Server scan results, from the server agent to your console
Never leaves
- File contents
- Full file paths
- Quarantined files — the portal cannot list desktop quarantine
Editions that include it
Local-first protection for your own computer and phone.
> One person, 1–3 devices
Provider interfaces for chosen-media checks and email exposure monitoring.
> Individuals who want the advanced checks
Monitoring and protection for Linux servers, with signed agent updates.
> Anyone running servers
One console for your servers, Android devices and alerts.
> Organisations with 5–250 devices
Each feature above names the platform or edition it runs on. An edition's own page lists the full state of that edition.
What to do if…
Practical steps that work whether or not you use our products.
Files suddenly have new extensions or will not open
- 1.Disconnect the computer from the network (unplug or turn off Wi-Fi). Do not shut it down yet.
- 2.Do not pay and do not run "decryptor" tools from unknown sites.
- 3.Check whether your backups are intact and offline before reconnecting anything.
- 4.Report it: to your IT contact, and in India to CERT-In or cybercrime.gov.in.
You want to be ready before it happens
- 1.Keep at least one backup copy offline or immutable, and restore a file from it every month.
- 2.Remove internet-facing remote access, or put it behind a VPN with two-step verification.
- 3.Patch internet-facing services first.
Limits and known gaps
- GAP-01Desktop apps have unsigned pre-release downloads. Local scanning and folder monitoring exist; platform signing and wider device verification remain pending. These previews do not prove protection against every ransomware family.
- GAP-02The burst rule is tested with a synthetic flag; the real counter is not tested. It watches approved folders only and cannot tell which process made the changes.
- GAP-03No automatic blocking, protected folders or rollback. By design, every automatic action is capped at WARN until an auditable policy exists.
- GAP-04The portal's ransomware page is configuration only: there is no detector behind it, and desktop quarantine stays on the device.
- GAP-05The register counts ransomware, malware and recovery sabotage as partial, wipers as observable only, and backup destruction as not observable.
Frequently asked
Will Sentinel stop ransomware?
Can a quarantined file be tampered with?
Why not delete suspicious files automatically?
Capabilities that work alongside it
A risk score built from real device signals: root, screen lock, encryption, risky apps.
Password exposure checks, account sign-in safety and hacked-account help today; verified-address monitoring interfaces need a configured provider for results.
DNS filtering and your own blocked and allowed lists on the phone; page-level browser protection is not built.