Ransomware and what comes before it
On each workstation: canary files, encrypted-file and mass-rename bursts, ransom notes, shadow-copy deletion and payload downloads through built-in Windows tools. The posture check flags an open Remote Desktop.
Ransomware precursors, credential phishing, account takeover, spoofing of your own domain and payment fraud, caught before the money moves or the files are encrypted. Vilkax Business also says plainly what it cannot see.
On a staff laptop, a system tool starts deleting Windows' recovery points: the step ransomware takes just before it encrypts. Vilkax recognises the command, never stores it, and alerts IT.
Vilkax Business
demo
Workstation · vssadmin.exe
A command that deletes Windows shadow copies starts running.
Ransomware precursor · backups being deleted
Recovery points are being removed. The command line itself is not stored.
The threats public reporting keeps naming as the costliest (ENISA Threat Landscape, Verizon DBIR, FBI IC3, CISA advisories). Each line says what the product does today.
Not covered yet: monitoring for staff credentials in breach dumps, data-exfiltration and personal-cloud upload detection, a software inventory checked against vulnerability feeds, and supplier risk scoring. We would rather say so than imply it.
Behaviours, not people: the workstation agent never reads window titles, documents, keystrokes or the screen.
Grouped the way risk, compliance and security teams think. Every match returns one explained verdict: pattern, evidence, confidence.
The money's gone before the alert fires. We catch it at the yes / no / review moment.
Caught by B2B fraud ML + the Protect APIStarter+
Structuring, shells and sanctioned counterparties hide between systems. We surface them as decision-support, including scam proceeds a single-lane vendor would never see.
Caught by B2B fraud ML + anti-scam intel + the OSINT moatPro+
One sanctioned hop can poison a payout. KYT screens any wallet or transaction in real time and returns an allow / review / block verdict with the evidence behind it.
Caught by KYT (Know-Your-Transaction) + the investigation enginePro+
Your hiring funnel, your approvals and your endpoints are the newest attack surface. We read the pattern and support your security and audit teams. Assessment only, never surveillance of a person.
Caught by B2B fraud ML + anti-scam intel + the AI Security ShieldPro+
Most loss starts with a message and a look-alike domain. We catch the lure before it lands a wire or a credential.
Caught by OSINT moat + the domain pulseStarter+
A device, wallet or payee reused across supposedly independent accounts is a fraud ring. A supplier shared by half your vendors is a single point of failure. We read both on the exposure graph.
Caught by entity intelligence + the exposure graphPro+
Assessment, not accusation. Vilkax detects patterns, never labels a person a criminal, and never auto-acts. High-stakes calls route to human review with the evidence. Every clear verdict carries a false-clear risk: thin coverage is flagged, not silenced.
Spans human → financial → on-chain in one model. Because Vilkax runs the consumer scam moat, we see a pig-butchering victim's payout land as scam-proceeds in a customer's AML picture - the consumer scam and the financial exposure together, an angle no single-lane vendor has.
Every verdict ships with reasons, evidence and a confidence score. Your team and your regulator both see exactly why.
Catches threats from day one with built-in intelligence. No model to train, no history needed.
When a source isn't live, the verdict says so. It never returns a clean result from missing data.
Assessment, not accusation. Auditable, PII-safe, built in-house.
No password. We email a secure sign-in link straight to your control panel. Up and running in under a minute.
Already with us? Open your control panel.
Tell us what you'd like to see and someone from the team will reply to set up a walkthrough.
Tweaks