Lessons from the Frontlines: Ransomware Attacks, New Techniques, and Old Tricks

SANS Ransomware Summit 2023 Lessons from the Frontlines: Ransomware Attacks, New Techniques, and Old Tricks Speakers: Peter O, Cyber Threat Analyst, The DFIR Report Alessandro Di Carlo, Forensics & Product Manager, Certego Srl Ransomware attacks are a constant threat faced by many organizations. In 2022 The DFIR Report continued to observe a number of ransomware-related attacks facilitated by a variety of initial access brokers. This talk will provide practical insights into attack lifecycle trends, initial access detections, new techniques observed and the continued use of familiar tools. We'll share detection opportunities for quick wins on identifying attackers on your network. Explore new and emerging discovery tools, and how detecting the adversary early in the attack lifecycle is key to stopping a ransomware attack unfolding. All details are based on 'Real Intrusions by Real Attackers, The Truth Behind the Intrusion.' It will serve as a practical guide for defenders to understand a typical attack. - Initial access by threat actors - Race to compromise, - Attack objectives - Can you detect and respond?, - Who is on your network? - Understanding human behaviours, - Attacker Tooling - New and old discovery techniques View upcoming Summits: http://www.sans.org/u/DuS