Ransomware Threat Landscape
summary
CrowdStrike reports tracking 154 adversaries and shows ransomware shifting from commodity malware to targeted operations using access brokers, Emotet/Dridex footholds, Cobalt Strike lateral movement, and exfiltration via Rclone and Mega to dedicated leak sites; ransom demands routinely reach millions and once hit $1.4 billion. Operators use Ryuk, Conti and REvil, run ransomware-as-a-service or full-stack campaigns, and now target ESXi/virtual machines and Linux containers. Defensive guidance centers on the 1-10-60 rule, NextGen AV, tested backups and least-privilege.
AI-written summary · about
chapters (15)
- 0:00Start
- 2:26Threat Actor and Motivation
- 3:04Nation State
- 4:39Hacktivism
- 6:14Chinese Threat Actors
- 11:15Underground Economy
- 12:26Banking Trojans
- 13:25Distribution Actors
- 13:53Access Brokers
- 19:52Traveling Spider
- 21:35Brief History of Ransomware
- 24:58Ransomware Payment in 2019
- 27:35Secure the Enterprise
- 28:14Prepare To Prevent
- 31:38Know Your Adversary
related talks
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
37mRansomware Resilience: Holistic Defense for SOC Leaders
33mLiving with Ransomware - The New Normal in Cyber Security
27mFrom RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
32mProspecting Ransomware Tech
32mSurviving a Ransomware Attack - Lessons from the Field
52mRansomware; The Real Pandemic
52mRansomware 101: Get Smart Understanding Real Attacks