Ransomware encryption activity following Phantom Mantis EDR-killer execution

Duo Tech@duotech

•updated Aug 4, 2026•0•0•5

Detects mass file renaming (ransomware-style encryption behavior) within 30 minutes after execution of Phantom Mantis EDR-killer tooling, indicating endpoint defenses were pinned immediately before ransomware deployment.