The 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
summary
Symantec threat hunters show ransomware now favors scanning internet‑facing servers (Exchange, Citrix, VPN appliances) and living‑off‑the‑land tools rather than spam, routinely exfiltrating 100–200 GB before encrypting. LockBit still accounts for ~20% of incidents. Dual‑use apps like Rclone and remote admin tools are the attackers’ main exfiltration vectors, often abused with vulnerable drivers. Symantec Adaptive Protection claims ~50% attack‑surface reduction by blocking unused behaviors and applying fine‑grained, environment‑specific controls.
AI-written summary · about
chapters (19)
- 0:002024 ransomware landscape intro
- 1:49Who fuels ransomware epidemic
- 5:00Ransomware attack vectors evolution
- 9:36Server-focused ransomware shift
- 10:18Ransomware tools and techniques
- 12:51Large data exfiltration by actors
- 15:03Traditional security limitations
- 17:48Why one-size protection fails
- 18:52How adaptive security works
- 23:50Adaptive security vs WannaCry
- 26:17Process lineage tracking
- 27:44Ransomware trends and impacts
- 28:45Internet-facing device targeting
- 30:07Need for adaptive protection
- 30:50Vulnerability management steps
- 31:52Next 3 months: Vuln management
- 32:53Mitigating zero-day exploits
- 33:37Selecting adaptive tech in 6 months
- 34:44Q&A on ransomware installation
related talks
40mRansomware Threat Landscape
52mRansomware; The Real Pandemic
40mRansomware: New Recipe For An Old Dish
33mLiving with Ransomware - The New Normal in Cyber Security
32mProspecting Ransomware Tech
52mRansomware 101: Get Smart Understanding Real Attacks
21mRansomware Attack: Lessons Learned
40mA Review of the Ransomware Threat Landscape