Ransomware; The Real Pandemic
summary
Firm receives about one ransomware cleanup call per week and reports 60% via RDP/remote access, 30% phishing, 10% patch gaps. Maze operators use credential theft with Mimikatz + Cobalt Strike, PSExec/PowerShell lateral movement, 7‑zip staging, hard‑coded C2 IPs, and routines to delete shadow copies and stop SQL services. SolarWinds compromise used Sunspot to implant Sunburst in builds. Recommended fixes: MFA, whitelist remote access, SIM/SIEM 24/7 monitoring, tight admin counts, and alerts for beacon/privileged‑use behavior.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:00Ransomware
- 3:40Agenda
- 4:43Attack Kill Chain
- 16:20SolarWinds
- 20:57Social Engineering
- 23:10RDP Abuse
- 30:40QA
- 32:10Getting hit with ransomware
- 33:10Getting the paperwork signed
- 34:10Ransomware attack vectors
- 35:10Paying ransom
- 36:10The goal of forensics
- 37:10How did they get in
- 39:10Collection and exfiltration
- 40:10Negotiation groups
- 41:10Unregulated industry
- 42:10Wrapping up
- 44:10Questions
- 46:10How do you bridge the gap
- 47:10No separation of duties
- 48:10Cyber breach insurance
- 49:10Cyber breach assurance
- 50:10Ransomware abatement
- 51:10Wrap up
related talks
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
21mRansomware Attack: Lessons Learned
37mRansomware Resilience: Holistic Defense for SOC Leaders
52mRansomware 101: Get Smart Understanding Real Attacks
40mRansomware: New Recipe For An Old Dish
40mRansomware Threat Landscape
32mSurviving a Ransomware Attack - Lessons from the Field
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack