{"id":88828,"date":"2018-05-11T13:00:10","date_gmt":"2018-05-11T20:00:10","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=88828"},"modified":"2025-06-05T19:35:18","modified_gmt":"2025-06-06T02:35:18","slug":"syn-ack-unique-proactive-protection-technique","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/","title":{"rendered":"Syn\/Ack Unique Proactive Protection Technique"},"content":{"rendered":"<p>McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are concerned about the potential impact of this ransomware but are currently unable to implement McAfee product protections, we have found a simple but interesting alternative method.\u00a0 Prior to encryption and ransom, the malware first checks if one of several hardcoded keyboards or languages is installed on the target machine.\u00a0 If found, the malicious code will terminate, effectively resulting in an extremely simple \u201cpatch\u201d of sorts. We have tested the following steps to be effective on several versions of Windows 7 and theoretically on Windows 10 \u2013 preventing the malware from encryption and ransom.\u00a0 These steps can be taken proactively.\u00a0 Due to limited scope of testing at this time, this technique may not work on all systems, release versions, and configurations.<\/p>\n<h2>Windows 7 \u2013 Adding Keyboard Layout:<\/h2>\n<p>Control Panel &gt; Clock, Language, and Region &gt; Region and Language &gt; Keyboards and Languages<\/p>\n<p>Click the \u201cChange Keyboards\u201d tab<\/p>\n<p>In the Installed Services section click \u201cadd\u201d<\/p>\n<p>Select Keyboard \u2013 For example: Russian (Russia) &gt; Keyboard &gt; Russian<\/p>\n<p>Click \u201cOk\u201d<\/p>\n<p>Click \u201cApply\u201d<\/p>\n<p>Click \u201cOk\u201d<\/p>\n<p>Here is the list of keyboards layouts you can add \u2013 any will suffice:<\/p>\n<ul>\n<li>Armenian<\/li>\n<li>Azeri, (Cyrillic, Azerbaijan)<\/li>\n<li>Belarusian<\/li>\n<li>Georgian<\/li>\n<li>Kazakh<\/li>\n<li>Ukrainian<\/li>\n<li>Uzbek (Cryillic, Uzbekistan)<\/li>\n<li>Uzbek (Latin,Uzbekistan)<\/li>\n<li>Russian<\/li>\n<li>Tajik<\/li>\n<\/ul>\n<h2>Windows 10 \u2013 Adding Language Support:<\/h2>\n<p>Control Panel &gt; Language &gt; Add a language<\/p>\n<ul>\n<li>Armenian<\/li>\n<li>Azeri, (Cyrillic, Azerbaijan)<\/li>\n<li>Belarusian<\/li>\n<li>Georgian<\/li>\n<li>Kazakh<\/li>\n<li>Ukrainian<\/li>\n<li>Uzbek (Cryillic, Uzbekistan)<\/li>\n<li>Uzbek (Latin,Uzbekistan)<\/li>\n<li>Russian<\/li>\n<li>Tajik<\/li>\n<\/ul>\n<p>That\u2019s all it takes!\u00a0 Please note \u2013 this should not be considered a fully effective or long-term strategy.\u00a0 It is highly likely the malware will change based on this finding; thus, we recommend the McAfee product protections referenced above for best effect.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are&#8230;<\/p>\n","protected":false},"author":912,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[5526,5423,32,4549],"coauthors":[5016,5354],"class_list":["post-88828","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-advanced-threat-research","tag-atr","tag-data-protection","tag-ransomware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Syn\/Ack Unique Proactive Protection Technique | McAfee Blog<\/title>\n<meta name=\"description\" content=\"McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Syn\/Ack Unique Proactive Protection Technique | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2018-05-11T20:00:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-06T02:35:18+00:00\" \/>\n<meta name=\"author\" content=\"Charles McFarland, Steve Povolny\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cgmcfarland\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Charles McFarland, Steve Povolny\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/\"},\"author\":{\"name\":\"Charles McFarland\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/dd97fbd2b395e0ef39887832e01f8f90\"},\"headline\":\"Syn\/Ack Unique Proactive Protection Technique\",\"datePublished\":\"2018-05-11T20:00:10+00:00\",\"dateModified\":\"2025-06-06T02:35:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/\"},\"wordCount\":292,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"keywords\":[\"Advanced Threat Research\",\"ATR\",\"data protection\",\"ransomware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/\",\"name\":\"Syn\/Ack Unique Proactive Protection Technique | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2018-05-11T20:00:10+00:00\",\"dateModified\":\"2025-06-06T02:35:18+00:00\",\"description\":\"McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Syn\/Ack Unique Proactive Protection Technique\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/dd97fbd2b395e0ef39887832e01f8f90\",\"name\":\"Charles McFarland\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/5bb2e1f370a6c4d3393ed44d01b286f3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Charles-McFarland-1-150x150.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Charles-McFarland-1-150x150.jpg\",\"caption\":\"Charles McFarland\"},\"description\":\"Charles McFarland is a Threats Researcher for McAfee. He has been working in the security industry since 2006, with a background in Threat Intelligence, Data Analysis, and Vulnerability Analysis. He has a Master of Computer Science in Intelligent Systems which he uses to understand the growing threat of AI by bad actors. He has authored multiple public security tools and has been published related to his Threat Intelligence work. Currently, he is engaged in predicting up-and-coming threats against consumers.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/charles-mcfarland-b4974613\/\",\"https:\/\/x.com\/cgmcfarland\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/charles-mcfarland\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Syn\/Ack Unique Proactive Protection Technique | McAfee Blog","description":"McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Syn\/Ack Unique Proactive Protection Technique | McAfee Blog","og_description":"McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2018-05-11T20:00:10+00:00","article_modified_time":"2025-06-06T02:35:18+00:00","author":"Charles McFarland, Steve Povolny","twitter_card":"summary_large_image","twitter_creator":"@cgmcfarland","twitter_site":"@McAfee","twitter_misc":{"Written by":"Charles McFarland, Steve Povolny","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/"},"author":{"name":"Charles McFarland","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/dd97fbd2b395e0ef39887832e01f8f90"},"headline":"Syn\/Ack Unique Proactive Protection Technique","datePublished":"2018-05-11T20:00:10+00:00","dateModified":"2025-06-06T02:35:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/"},"wordCount":292,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"keywords":["Advanced Threat Research","ATR","data protection","ransomware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/","name":"Syn\/Ack Unique Proactive Protection Technique | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2018-05-11T20:00:10+00:00","dateModified":"2025-06-06T02:35:18+00:00","description":"McAfee\u2019s Advanced Threat Research team has performed analysis on samples of Syn\/Ack ransomware implementing Process Doppelg\u00e4nging.\u00a0 For those who are","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/syn-ack-unique-proactive-protection-technique\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Syn\/Ack Unique Proactive Protection Technique"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/dd97fbd2b395e0ef39887832e01f8f90","name":"Charles McFarland","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/5bb2e1f370a6c4d3393ed44d01b286f3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Charles-McFarland-1-150x150.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/05\/Charles-McFarland-1-150x150.jpg","caption":"Charles McFarland"},"description":"Charles McFarland is a Threats Researcher for McAfee. He has been working in the security industry since 2006, with a background in Threat Intelligence, Data Analysis, and Vulnerability Analysis. He has a Master of Computer Science in Intelligent Systems which he uses to understand the growing threat of AI by bad actors. He has authored multiple public security tools and has been published related to his Threat Intelligence work. Currently, he is engaged in predicting up-and-coming threats against consumers.","sameAs":["https:\/\/www.linkedin.com\/in\/charles-mcfarland-b4974613\/","https:\/\/x.com\/cgmcfarland"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/charles-mcfarland\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/88828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/912"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=88828"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/88828\/revisions"}],"predecessor-version":[{"id":215162,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/88828\/revisions\/215162"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=88828"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=88828"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=88828"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=88828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}