Sophos CryptoGuard Ransomware Protection and Rollback

CryptoGuard watches behavior, not only known ransomware names

Traditional signatures ask whether a file matches known malware. CryptoGuard watches what a process does to documents and other valuable files. Rapid or suspicious encryption can be stopped even when the executable has no familiar ransomware family name. Sophos describes the Home component as detecting and blocking file-encryption behavior and rolling back affected files when recovery is available.

Behavior monitoring matters because an attacker can change filenames, pack a payload or use a legitimate tool to perform destructive writes. It also explains why a legitimate backup, development, media or encryption application can trigger concern: the behavior can resemble the destructive stage of ransomware. An alert is strong reason to stop and investigate, not automatic proof that the named application is criminal.

CryptoGuard is one layer in Sophos Home. Real-time malware detection, exploit protection, malicious-site blocking and other controls try to stop the attack before encryption. CryptoGuard is the last behavioral guard when those earlier layers are bypassed. Our current Sophos Home review covers the whole product and independent lab record; this page isolates what can and cannot be claimed about the ransomware component.

Sophos Home is not Sophos Central or Intercept X Endpoint

Search results repeatedly mix the consumer and business products because both use the CryptoGuard name. Sophos Central documentation can include threat graphs, policy-based root-cause analysis, remote endpoint isolation, Detection IDs, managed network-share controls and administrator workflows. Those are not documented Sophos Home features.

Sophos Home gives a household administrator a browser dashboard, endpoint status, protection settings, events and support. It does not become an EDR or MDR service because an enterprise CryptoGuard article appears above a Home result. A home user should not look for a Central policy named “Protect document files from ransomware,” a server alert about a remote IP or a threat graph that the consumer dashboard never promised.

This boundary also affects test evidence. A Sophos Endpoint or Intercept X ransomware demonstration can show what the broader enterprise stack did in that configuration. It does not prove that Home has the same telemetry, tuning, management response or recovery result. We use Home support pages for Home behavior and identify enterprise guidance only when it supplies general incident-response context.

Ransomware Security is listed for Windows and macOS

The current Sophos Home feature matrix lists Ransomware Security for Windows Premium, macOS Premium and the Premium Trial. The trial protects up to three computers for 30 days; a paid Premium account covers up to ten mixed Windows and Mac computers. A grandfathered Free license should not be assumed to match current Premium coverage without checking its dashboard.

Phones and tablets use Sophos Intercept X for Mobile, a separate product that does not join the Home dashboard or consume a desktop seat. Windows ARM, ChromeOS and Linux are outside Sophos Home’s supported computer matrix. Do not assign CryptoGuard coverage to an unsupported platform merely because the account can open in its browser.

Confirm the affected endpoint is current, protected and reporting before trusting an alert or silence. The dashboard and device guide explains ownership and stale status; the installation guide covers platform permissions and health checks.

The 3 GB requirement makes recovery possible, not certain

Sophos requires 3 GB of available hard-drive space for its ransomware module and recovery tasks, beyond the base product allowance. The current system requirements call out that additional space on both Windows and Mac. The Mac alert guide says the process can be stopped while files remain encrypted when free space is insufficient.

Keep more than the bare minimum because operating-system updates, browser caches and normal applications can consume it without warning. A computer hovering around 3 GB has little room for the OS, Sophos updates or recovery work. Low space is also an operational warning: confirm that backups are current before deleting data in a rush to create room.

Free space is only one gate. It does not prove CryptoGuard observed every affected write or retained everything needed for restoration. A healthy dashboard and 20 GB free do not turn conditional rollback into an unlimited snapshot system.

Sophos Home’s two current rollback explanations need a conservative reading

The current general Sophos Home ransomware guide says CryptoGuard may stop ransomware before encryption and warns that rollback can be unavailable depending on how and when the process is stopped. The current Mac File Encryption Blocked article says Sophos can stop the process and decrypt already changed files when at least 3 GB is available.

Those statements describe possible recovery, not a promise for every attack. Recovery is not guaranteed. Our rule is the stricter one: expect automatic restoration only when the alert confirms it, then validate the files. Do not assume “blocked” means every document is back, and do not overwrite surviving originals with unverified recovered copies.

Sophos Home offers no arbitrary manual rollback for an event hours later; it does not document a consumer button for that job. CryptoGuard recovery is tied to the detected event. If files remain encrypted, recovery moves to clean backups or a trusted decryptor for the identified family.

Rollback cannot reverse the whole intrusion

Modern ransomware operations may steal browser cookies, passwords, tokens, documents or cloud data before encryption. An automatic file restore cannot revoke those credentials, delete an attacker’s copy or prove that persistence is gone. It also cannot repair every application configuration, scheduled task, remote-access tool or account change made earlier.

Encrypted documents and ransom notes are outcomes of the attack. Sophos explicitly says antivirus products often do not detect or clean them as malware. A Full Scan can find a remaining executable or related threat, but a clean result does not decrypt data or certify the incident closed.

Think of four separate outcomes: stop the active process, remove malicious code, restore trustworthy data and remove the access path that allowed the attack. CryptoGuard can help with the first and sometimes the third. The household or incident responder still owns the other two.

A CryptoGuard alert is a triage event, not a restore button

Record the computer, exact alert wording, application, full path, time and files involved before dismissing anything. Check whether documents still open normally, whether extensions changed and whether a ransom note exists. If files are readable and no broader indicators appear, the process was likely stopped before visible damage—but it still needs verification.

A legitimate application can perform bulk writes, compression, encryption or conversion. A malicious executable can use a trustworthy-looking name or inject into a legitimate process. Judge the exact path, signature, source, hash, version and expected behavior together. Recognition alone is not evidence.

Use the selected computer’s New Activity or History view and preserve a screenshot or exportable details where available. Our scan, quarantine and exclusions guide explains sample verification, Intelix, VirusTotal’s limits and why a narrow exception comes after—not before—independent confirmation.

Choose the response by whether the data is still usable

The fastest safe split is practical. If Sophos blocked a process and files still open, keep the application stopped while you verify it. If files are encrypted or a ransom note exists, treat the machine as an active incident: isolate first and delay recovery until scope and access are understood.

Do not run a suspicious process again just to see whether the alert repeats. Do not reconnect an external backup to check if its files survived. Evidence and clean copies are harder to recover after a second execution or another synchronized overwrite.

On Mac, follow the File Encryption Blocked path deliberately

Click the Mac alert and open the detected path. If the application is unexpected or fails verification, delete it, empty Trash and run a Full Scan. Sophos’ Mac article recommends contacting the application vendor before treating a suspected false positive as safe.

For a confirmed legitimate application, the alert’s View Dashboard route can add it to Ransomware exclusions. Restart the Mac, retest the exact operation and check that protection returns to a healthy state. The exclusion should name the verified application, not a broad development, media or home directory.

If files remain encrypted because recovery did not run or space was insufficient, stop experimenting on the originals. Duplicate evidence to controlled media if an incident responder needs it, identify the family and restore working data from a clean copy only after the Mac is cleaned or rebuilt.

Verify a possible false positive without trusting the filename

Collect the official download source, publisher signature, application version and a cryptographic hash. Ask the vendor whether this version performs the observed bulk write or encryption. Check whether the executable lives in its normal signed installation path or an unexpected temporary, mail or user-data location.

Use Sophos’ current sample submission workflow in Guest mode for an uncertain file. Multi-engine results are indicators, not verdicts, and proprietary or personal files should not be uploaded to a public service without permission.

Real community reports show why the evidence matters. An r/sophos WhatsApp alert discussion focused on the unexpected path rather than trusting the app name, while a Windows update false-positive thread illustrates that legitimate system activity can cross a behavioral threshold. Both are directional enterprise/community evidence, not instructions for Sophos Home exclusions.

A ransomware exclusion is a permanent blind spot until removed

An exclusion tells CryptoGuard to tolerate the confirmed application’s encryption-like behavior. It should contain the smallest application scope the Home interface permits, an owner, a reason and a review date. Remove it after the vendor or Sophos fixes the conflict.

Do not disable all Ransomware Protection because one application is inconvenient. Sophos’ current Windows game compatibility article documents one specific case with no available exclusion and calls temporary disabling risky. Its own sequence requires immediate re-enabling and a restart. That workaround is not a general performance setting.

If a test absolutely requires disabling protection, disconnect unneeded data and shares, verify the installer from the official vendor, time-box one test and restore protection before normal use. A working program only proves the control caused the conflict; it does not prove the program is safe.

If files are encrypted, disconnect the computer before recovery

Remove Wi-Fi and Ethernet access, disconnect mounted shares and unplug removable backup media. Do not sign into cloud storage from the affected machine. Sophos and the CISA #StopRansomware response checklist both prioritize isolation so the attack cannot keep reaching other systems or storage.

Prefer network isolation over immediate power-off when it can be done safely, because shutting down can destroy volatile evidence. A household without forensic support may still have to power off if isolation is impossible and encryption is continuing. Businesses, regulated data owners and multi-device incidents should contact an incident responder and insurer before changing evidence.

Do not reconnect the computer because one document opens after rollback. Confirm whether other devices, shares, sync folders, email and backup accounts were touched. The encryptor may be stopped while the access path remains active.

Preserve the small set of evidence that makes recovery safer

Save the ransom note, one or two encrypted sample files, original extensions, the Sophos event, computer name, date and time, suspicious message or download source and any contact address or wallet in the note. Do not rename or edit the only samples. Photograph the screen with a separate clean device when copying data would change the machine.

Preserve the suspected executable or email attachment only in a controlled, non-executing form and follow responder instructions. Do not send malware through ordinary email or upload private documents to random “decryptor” websites. A trusted identification service usually needs a small encrypted sample and the ransom note, not the whole personal archive.

Evidence helps distinguish an incomplete rollback from a different storage problem and identifies whether a decryptor exists. It also supports a report and a root-cause investigation so the restored computer is not compromised again.

Check shares, cloud sync and accounts from a clean device

Look for changed extensions, ransom notes and unusual sync activity on other household computers without opening suspicious files. Pause affected cloud synchronization through the provider’s clean web interface when possible. Preserve version history rather than deleting encrypted cloud objects in bulk.

From a known-clean device, change passwords for the primary email, password manager, cloud storage, backup service, Sophos account, remote-access tools and financial accounts if exposure is plausible. Revoke sessions and tokens, enable MFA and check forwarding rules or recovery methods. Password changes made on the compromised machine can be stolen again.

Assume any reachable network share or attached drive was at risk. A mapped drive with unchanged top-level folders can still contain encrypted files deeper inside. Validate scope before selecting the backup date used for restoration.

Stopping malware, cleaning the computer and recovering data are separate jobs

First stop active encryption. Next identify and remove the payload, persistence and access path. Then rebuild or validate the operating system and protection. Only then restore data from a point known to predate the compromise. Reversing that order can infect the restored copy or synchronize encrypted files back into it.

Sophos recommends checking that Home updates and reports correctly, resolving errors and running Full Scans on affected devices. A damaged application may need reinstallation because ransomware can encrypt configuration files. The Full Scan is a health check; it is not a replacement for account review, evidence analysis or a clean rebuild when trust is lost.

Restore into a clean location first and open representative documents before replacing the only good backup. Check dates, hashes where available and application behavior. Keep the pre-restore evidence until the household is confident that needed files and accounts are working.

Use trusted identification and decryptors; do not assume payment works

The No More Ransom Crypto Sheriff can compare an encrypted sample and ransom-note details against known families and link to an available decryptor. Sophos also points Home users to ID Ransomware while noting that it is not a Sophos-supported service. Use small non-sensitive samples and verify the domain before uploading anything.

Most modern ransomware cannot be decrypted without the key, and a tool for one family or version can damage data from another. Work on copies. Never download a decryptor from the ransom note, an advertisement or an unknown forum account.

The FBI does not support paying a ransom: payment does not guarantee recovery and funds further attacks. US victims can report through IC3 or an FBI field office; people elsewhere should use their national cybercrime authority. A business facing legal, safety or extortion decisions needs professional counsel, incident response and its insurer.

A ransomware backup must survive the everyday computer and account

Cloud sync is convenient but not automatically a backup. It can replicate renames and encrypted writes in seconds. Provider version history helps only when retention is long enough and the attacker cannot delete it with the same account.

CryptoGuard and backups complement each other. The endpoint layer can limit damage before the backup is needed; the independent backup covers missed encryption, theft, hardware loss, accidental deletion and failed rollback.

Keep ransomware from reaching the encryption stage

Patch the operating system, browsers, document readers and exposed remote-access software promptly. Remove unused remote desktop and remote-management tools, use a standard account for daily work and reserve administrator rights for deliberate changes. Sophos Home’s tamper protection and healthy update status also matter because attackers increasingly try to disable security before encryption.

Show full file extensions and treat unexpected archives, JavaScript, shortcuts and macro-enabled documents as untrusted. Do not enable macros because a message claims the invoice or delivery notice requires it. Verify the sender through a separate channel. Block unsupported software and retire systems that no longer receive security updates.

Use MFA for email, cloud storage, backup and password-management accounts. Keep recovery codes outside the protected computer. Practice one small restore and one account-recovery exercise before an incident; the family should know how to disconnect Wi-Fi, identify the backup owner and contact help without using the compromised device.

Current evidence supports the feature, not a guaranteed recovery rate

Sophos Home’s current support articles document behavior blocking, conditional rollback and the Mac response. Current whole-product lab results say whether the suite stopped test attacks overall; they do not isolate a reproducible CryptoGuard Home recovery percentage across ransomware families, file types, disks and platforms.

Community reports are useful for questions—where rollback copies go, why legitimate applications trigger, and whether exclusions are too broad—but most detailed threads concern Sophos Central or older component versions. We do not transfer their Detection ID steps or server-share behavior into Home.

The defensible conclusion is narrower and more useful: CryptoGuard is an important last behavioral layer on a supported, healthy computer with adequate free space. It improves the chance that encryption is stopped and some files are restored. It does not remove the need for containment, account security, clean recovery and tested backups.