Malware might adapt, but “low and slow” isn’t viable for their business model. They need the “shock and awe” of everything being encrypted all at once.
A low-and-slow attack would need to transparently encrypt files over a long period, and pulling out they key material all at once. Something like Windows EFS could probably be leveraged to do that kind of attack, but stock EFS would show up in the UI. A malicious EFS replacement that hides in the filesystem filter stack would definitely do it.
That would be a ton more work and would probably be easier to detect (and have tons of compatibility issues, I’m sure).
A low-and-slow attack would need to transparently encrypt files over a long period, and pulling out they key material all at once. Something like Windows EFS could probably be leveraged to do that kind of attack, but stock EFS would show up in the UI. A malicious EFS replacement that hides in the filesystem filter stack would definitely do it.
That would be a ton more work and would probably be easier to detect (and have tons of compatibility issues, I’m sure).