Prospecting Ransomware Tech
summary
2017 spawns about 150 ransomware families (roughly 12 new families per month) with only about 10% recoverable using current decrypters; delivery mixes include SMB exploits like EternalBlue, RDP brute force, Emotet-style packers, botnets and coinminers, and some use low‑level disk/sector encryption (NotPetya/GoldenEye). RaaS operators hand out payloads with a 70/30 revenue split, many samples contain bugs (e.g., incorrect large‑file handling, key‑correlation errors) that sometimes destroy data, and most strains delete themselves rather than maintain persistence. Tools: ransom note/file ID services and bespoke decrypters.
AI-written summary · about
chapters (8)
- 0:00Introduction to ransomware
- 3:23Ransomware families and recovery
- 10:15Shift to targeting companies
- 13:53Ransomware as a service model
- 17:22Common user mistakes
- 22:19Ransomware creators' mistakes
- 27:02Ransomware deployment methods
- 30:12Q&A on ransomware persistence
related talks
40mRansomware: New Recipe For An Old Dish
40mRansomware Threat Landscape
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
37mRansomware Resilience: Holistic Defense for SOC Leaders
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
33mLiving with Ransomware - The New Normal in Cyber Security
38mCracking a ransomware family
33mThe Evolution of Ransomware - from Floppies to Droppers