Malware can easily attack a system by encrypting an entire file. However, encrypting small file blocks is a more sneaky approach that takes less time to complete the attack. For malicious hackers, time is a critical factor, and encrypting gigabytes or terabytes of data can be time-consuming compared to encrypting a few 10-megabyte blocks. Intermittent encryption modifies only small portions of a file, mimicking legitimate software that updates small file blocks. When compressed blocks in a legitimate file become corrupt, the whole file becomes unreadable. Similarly, if only part of a file is modified by ransomware, the whole file becomes unusable. Hackers are increasingly using intermittent encryption, thanks to various automated implementations available through ransomware as a service (RaaS), a subscription service model that enables hacker affiliates to use predeveloped ransomware tools to launch attacks. Intermittent encryption can be used as a way to get around some of the protection used by anti-ransomware tools. By encrypting files in small intervals, ransomware attackers can avoid detection or extend the time it takes for their activity to be detected and stopped. This can also make it more difficult for anti-ransomware tools to recover files. Security analysts anticipate that more ransomware gangs will adopt intermittent encryption due to its significant advantages and few downsides. The LockBit strain is already known for its fast encryption speeds, and adopting partial encryption would further reduce the duration of their attacks to mere minutes. However, intermittent encryption must be implemented correctly to ensure that victims cannot easily recover their data. Encryption is a complex process, and mistakes in implementation could compromise the effectiveness of the attack. Currently, BlackCat's implementation of intermittent encryption is the most advanced, while the details of Qyick's implementation remain unknown since malware analysts have not yet analyzed samples of the new Ransomware-as-a-Service (RaaS).