Ransomware Resilience: Holistic Defense for SOC Leaders
summary
2023 ransomware activity grows ~55% year-over-year with LockBit and ALPHV dominant, rise of affiliate initial-access brokers, supply‑chain hits and encryptionless extortion tied to the SEC four‑day disclosure rule. Scattered Spider gains admin access via LinkedIn reconnaissance, vishing, SIM‑swap and MFA‑fatigue, then uses ALPHV/BlackCat RaaS, GPO/Task Scheduler, Mimikatz and remote‑control tools to exfiltrate via custom ETL before demanding double extortion. Recommended controls: ZTNA, network segmentation, SSL inspection, endpoint DLP, hardware FIDO2 MFA, and analytics products like Risk360 and Breach Predictor.
AI-written summary · about
chapters (8)
- 0:00Ransomware resilience intro
- 2:552023 trends and SEC impact
- 13:47How ransomware attacks unfold
- 23:08Prevent lateral spread
- 26:04Double extortion tactics
- 30:14Risk360 breach predictor
- 34:38High-impact security actions
- 36:26Q&A
related talks
40mRansomware Threat Landscape
52mRansomware; The Real Pandemic
52mRansomware 101: Get Smart Understanding Real Attacks
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
33mLiving with Ransomware - The New Normal in Cyber Security
40mRansomware: New Recipe For An Old Dish
32mProspecting Ransomware Tech
32mSurviving a Ransomware Attack - Lessons from the Field