Keynote | A Post-Apocalyptic Hellscape: What Ransomware Looks Like After RaaS
Speaker: Allan Liska, CSIRT, Recorded Future
For several years Ransomware as a Service (RaaS) drove the growth of ransomware, but that has changed. The combination of stepped-up law enforcement and group infighting has made being part of a large open RaaS operation more dangerous, especially for threat actors who live outside of Russia. In the new ransomware "world" there is the LockBit warlord and everyone else. Most "new" ransomware groups are scavengers using stolen bits of code that they piece together to build shady "Franken-ransomware" that may or may not be decryptable. Into this hellscape steps ransomware defenders who now have to navigate smaller groups of threat actors who often don't know what they are doing and can't be relied upon to deliver what they promised. This talk will look at the new world of ransomware and what it means for defenders and incident responders.
2