An analysis of the encryption speed of ten notorious ransomware strains finds LockBit and Babuk to be the fastest, while Conti, Maze, and PYSA were the slowest
Bill Toulas / BleepingComputer : Source: Splunk .
Context & Ripple Effects
LockBit's arc makes this Splunk benchmark more than a curiosity: researchers flagged it in 2020 as an increasingly prevalent strain that might one day rival Maze or Ryuk, and it went on to become the dominant ransomware-as-a-service brand before a global law-enforcement operation dealt it a major blow in February 2024. Measuring which strains encrypt fastest is effectively measuring which codebases won the affiliate market.
The speed ranking also intersects with a stealth arms race: months after this analysis, gangs adopted [[a:1155039|intermittent encryption that partly encrypts files to evade detection tools watching for intense file I/O]], showing that raw encryption throughput and evasiveness are competing design goals in ransomware development.
First-order effects
- Defenders running Splunk tooling get a concrete detection-tuning benchmark: LockBit and Babuk's fast encryption compresses the response window, while slow strains like Conti, Maze, and PYSA leave a longer I/O footprint to catch.
Second-order effects
- RaaS developers now face a visible trade-off — LockBit's speed made it the affiliate market's top brand, but the shift to intermittent encryption shows rivals trading throughput for stealth, forcing buyers to weigh speed against detectability.
Third-order effects
- If encryption speed and I/O evasion keep co-evolving as competitive axes, file-I/O-based detection erodes as a primary control, pushing enterprise defense further toward offline backups and behavioral detection — while law-enforcement pressure on big brands like LockBit accelerates turnover toward faster, quieter successors.
The trend: Ransomware development is shifting from raw encryption speed toward stealth-optimized variants, as I/O-based detection and law-enforcement takedowns squeeze out the loud, fast incumbents.