A few days ago I noticed a discussion on a website about cryptolockers. Someone said a cryptolocker operates silently untill it has encrypted all files and then comes visible to the user.
The working method was to silently encrypt all files. After it's done, the cryptolockers waits a few weeks and activates itself so there is no present back-up available. If a user tries to open a document in the waiting period, the cryptolocker quickly decrypts the file so you wont notice the encryption.
I don't know if this is true but I haven't heard anyone ever talk about this technique apart from that particular person.
Personally I hardly believe that this kind of cryptolocker exists. like what if the encrypting process/executable is deleted? does that mean all files slam shut or stay open because it can't communicate with the criminal's servers?
I've witnessed about 4 cryptolock attacks on our network. All were immediately noticed because the files were encrypted. you could also tell by the help_decrypt.txt files located in the encrypted directories.