Ransomware: Understand. Prevent. Recover.

With more than 20 years of experience in ransomware and information security, Allan Liska has improved countless organizations’ security posture using more effective intelligence. Liska provides ransomware-related counsel and key recommendations to major global corporations and government agencies, sitting on national ransomware task forces and speaking at global conferences. Liska has worked as both a security practitioner and an ethical hacker at Symantec, iSIGHT Partners, FireEye, and Recorded Future. Regularly cited in The Washington Post, Bloomberg, The New York Times, and NBC News, he’s a leading voice in ransomware and intelligence security. Liska has authored numerous books, including “The Practice of Network Security,” “Building an Intelligence-Led Security Program,” “Securing NTP: A Quick-Start Guide,” “Ransomware: Defending Against Digital Extortion,” and “DNS Security: Defending the Domain Name System.” Introduction How We Got Here: A History of Ransomware The Evolution of Ransomware Thinking Like a Cybercriminal: Motivation of Ransomware Actors Who Are the Big Ransomware Groups Today? Cryptocurrency, RaaS, and the Extortion Ecosystem Ransomware and Cryptocurrency Ransomware Negotiators The Commoditization of Ransomware The Rise of RaaS Double, Triple, and Quadruple Extortion Tabletop Exercises Getting the Right People Involved Running Tabletop Exercises on a Regular Basis Creating Plausible Scenarios Really Testing Assumptions Following up and Making Improvements Creating Disaster Recovery and Incident Response Plans What’s the Difference Between DR and IR? Points to Consider for Your DR Plan Points to Consider for Your IR Plan Storing and Updating the DR and IR Plans Ransomware Backup Strategy Developing Ransomware-Resistant Backups Testing Backups with Ransomware in Mind Restoring from Backup After a Ransomware Attack Anatomy of a Modern Ransomware Attack Initial Access Reconnaissance and Lateral Movement Exfiltration Deployment Extortion Credential Markets and Initial Access Brokers The Growth of IABs Is Directly Tied to Ransomware The Size of the Underground Stolen Credential Market How IABs and Ransomware Actors Use Stolen Credentials Phishing Attacks The Long History of Phishing and Ransomware Ransomware and Phishing Today Conducting Proper Phishing Training RDP and Other Remote Login Attacks The Rise of RDP and Other Remote Accesses During the Pandemic RDP Is an Easy Attack Vector for Ransomware Protecting Remote Access Exploitation Common Vulnerabilities Exploited by Ransomware Exploitation vs. Phishing and RDP Attacks Exploitation and Managed Service Providers Ransomware and Zero-Day Exploits Practical Patching Advice The Handoff from IABs to Ransomware Affiliates Two Groups, Same Attack How Does the Handoff Work? MITRE ATT&CK® Threat Hunting A Little Bit About Ransomware and Threat Hunting Tools Used by Ransomware Actors Cobalt Strike Tools Used by Network Defenders Sysmon: The Best Tool That No One Uses Ransomware and Active Directory Network Segmentation and Domain Controllers Gaining Access to the DC Mimikatz AdFind Deploying Ransomware from the DC Honeypots and Honeyfiles Honeypots As Effective Alerting Tools Building a Honeypot Creating a Honeyfile Taking Action on Alerts This Is Your Last Chance Deletion of Shadow Copies Starting the Encryption Process Endpoint Detection and Response + Automation Is Your Friend Hitting the Panic Button: Stopping a Ransomware Attack Now! Initial Response Don’t Panic Contain the Attack Assess the Damage Get Everyone in and Put Together Plans Implementing DR and IR Plans Take Care of the Basics: Food and Shelter Find the Initial Access Vector and Shut It Down Communicate, Communicate, Communicate Ignore Pressure from the Ransomware Group Prepare Everyone for a Long Slog Outside Help How To Determine You’re in Over Your Head Know Who To Call Tasks the Outside Experts Can and Cannot Help With Listen to the Experts The Most Asked Question: Should We Pay the Ransom? You Have to Pay the Ransom, What’s Next? The Work Is Just Beginning What’s the Answer? _30j0zll _1fob9te _3znysh7 _2et92p0 _tyjcwt _3dy6vkm _1t3h5sf _4d34og8 _2s8eyo1 _17dp8vu _3rdcrjn _1fob9te _3znysh7 _2et92p0 _tyjcwt _3dy6vkm _1t3h5sf _3znysh7 _2et92p0 _tyjcwt _3dy6vkm _1t3h5sf _30j0zll _1fob9te _3znysh7 _tyjcwt _3dy6vkm _1t3h5sf