Does Kaspersky Anti-Ransomware Tool require access to Internet for it to function?

[Partha]

I was curious to know if KART requires access to the Internet for it to work. Reason I asked this is that while testing it, I had disabled the Internet and ran some malware samples, and it did not seem to do anything, however after enabling the Internet, it did block those files. 

I would appreciate if someone from Kaspersky answers this please.

[Partha]

Update: I unblocked the files KART detected from the settings and then ran the files.......... It let them run 

after a while, I downloaded those files in the zipped form, disabled the Internet and right as I extracted those files, they were blocked instantaneously on access......... 

So, here's my question - Shouldn't KART have triggered the on-access scan and blocked the files right away after I had unblocked them, since they were not excluded...?






 

[harlan4096]

I would say that it needs connection since it also uses KSN technology.

[Partha]

7 hours ago, harlan4096 said:

I would say that it needs connection since it also uses KSN technology.

I see. Could you also shed some light wrt the second post in this thread?

[harlan4096]

Probably because it uses a cache for detections, that is saved locally, when You allowed the execution, it did but only temporally, but as You downloaded again, were detected.

[Vasily Burov]

Hi, @Partha!

What version of KART did you use? Internet connection was enabled when you unblocked the malware scripts and run them again? These are windows executable files? How did you run them?

Thanks.

[abdulwahab]

Yes, Kaspersky Anti-Ransomware Tool (KART) requires access to the internet to function properly. It uses the Kaspersky Security Network (KSN) to get real-time information about new threats and to update its databases. Without an internet connection, KART will not be able to provide the best possible protection against ransomware.

However, KART can still block some known ransomware threats even without an internet connection. This is because KART uses a variety of detection methods, including signature-based detection and behavioral analysis. However, without access to the KSN, KART will not be able to detect and block new or emerging ransomware threats.

In your test case, it is likely that KART was able to block the ransomware files after you enabled the internet connection because it was able to download updated databases from the KSN.