Genetic Algorithms Evolve Ransomware That Stays Under Behavioral Monitors' Entropy Thresholds

arXiv 2608.19821·medium signalXBlueskyLinkedInCopy link

Defenders should know this threat model is now being published: the authors frame ransomware execution as a Search-Based Software Engineering optimization problem rather than the traditional mass-encryption approach that triggers immediate detection. A genetic algorithm optimizes data encryption under a hard constraint on statistical deviation from baseline system activity, targeting the persistence gap where modern attacks aim to stay hidden for hours rather than minutes. The evolved patterns evade behavioral monitors under fingerprinting techniques, which means entropy-threshold and volume-based detection heuristics are the wrong place to anchor ransomware defense.