Ransomware payload delay x months?

[AlbieNorth]

Hi all,

Some discussion here regarding how long ransomware has been known to sit idle (in some variants) before launching its payload action. I have seen 2 months and sometimes 3 months on forums. Has anyone seen anything much longer?

Thanks

[Dima P.]

Hello Albert.

AV signatures may recognize ransomware after some point it time (signatures are constantly updated but with a small delay), if ransomware sits too long - there is a change AV database gets it's signature and it's going to be recognized as threat. That's in theory and I'd say never underestimate ransomware.

[Gostev]

Ditto. It does not have a luxury to wait for too long.