Researchers have recently observed a previously unnamed ransomware dubbed “Rorschach” that they emphasize to be “one of the fastest ransomware observed, by the speed of encryption.” In the observed instance, researchers noted that Rorschach was deployed “using DLL side-loading of a Cortex XDR Dump Service Tool, a signed commercial security product,” which is a loading method that is not typically utilized by ransomware operations and uses three (3) files during execution. The main payload is injected into “notepad.exe” and then runs processes in SUSPEND mode while providing falsified arguments. This technique is conducted to make analysis more difficult as well as deleting shadow volumes and backups by using legitimate Windows tools, clearing specific Windows event logs, disabling the Windows firewall, and attempting to stop a number of predefined services. Researchers explained that Rorschach has interesting capabilities that are not commonly seen in ransomware, such as making direct calls using the “syscall” instruction in order to evade defense mechanisms. Rorschach also employs a “highly effective and fast hybrid-cryptography scheme,” which encrypts only a specific portion of the original file content rather than the entire file. Researchers emphasized that these capabilities, amongst others, allowed the ransomware to encrypt an environment in only four (4) minutes and thirty (30) seconds. LockBit 3.0, another known fast ransomware strain, encrypted an identical environment in seven (7) minutes. Despite having no clear-cut overlaps with any known ransomware groups, Rorschach has similarities to the leaked source code of Babuk ransomware and is suspected of taking inspiration for some components from LockBit 2.0. The ransom note also has similarities to Darkside and Yanlowang. CTIX analysts will continue to monitor Rorschach for new activity. Indicators of compromise (IOCs) as well as additional technical details can be viewed in the linked report.