Ransomware detection engine enhancement

Datto EDR now includes a major update to its Ransomware Detection engine, expanding protection against both emerging ransomware operations and established threats. The update deploys automatically, is fully backward-compatible and requires no action from your team.

New targeted detections provide more focused protection against five ransomware families and operations that have emerged or increased activity:

• LYNX – A double-extortion ransomware threat that encrypts systems while also stealing data, giving attackers multiple ways to pressure victims.
• DragonForce – A ransomware-as-a-service operation that works with affiliates to carry out attacks and has been associated with data theft, encryption and double extortion.
• Gentlemen – An emerging ransomware operation first observed in 2025 that steals sensitive information before encrypting files and threatening to publish the stolen data.
• Chaos – A customizable ransomware builder used to create many different variants. Some versions have gone beyond encryption and overwritten data, making recovery much harder without reliable backups.
• CMD – A newer ransomware operation observed in 2026 that combines encryption with data theft. Its operators have also experimented with auctioning stolen information through their leak site to increase pressure on victims.

Detection has also been strengthened for several active and well-known ransomware threats. Akira, active since 2023, has targeted both Windows and Linux environments, including VMware ESXi infrastructure; Datto EDR can now identify Akira before encryption begins. Qilin is a ransomware-as-a-service operation capable of targeting Windows, Linux and VMware ESXi systems, with attacks commonly combining encryption and data theft; this update improves how quickly its activity is detected. PLAY, which has affected businesses and critical infrastructure since 2022, receives strengthened detection coverage, while WannaCry, the well-known ransomware associated with Windows SMB vulnerabilities, receives reinforced protection because older threats can still affect vulnerable systems.

Alongside the new ransomware coverage, Datto EDR now better recognizes more suspicious activity that can appear before an attack reaches the encryption stage. Refined detections also help reduce false positives, while improved agent startup resilience and more detailed logging give MSP technicians clearer information for triage, investigation and support. The result is earlier warning of ransomware activity with fewer unnecessary alerts competing for your team’s attention.

Learn more about the Q3 2026 ransomware detection update for Datto EDR here.