Surviving a Ransomware Attack - Lessons from the Field
summary
Case studies show initial access via RDP brute force into an exposed domain controller, creation of a backdoor admin account, internal scanning with Advanced IP Scanner, credential harvesting with mimikatz and PSExec, and deletion of shadow copies via vssadmin before encryption. A Ryuk campaign moves from Bazar loader to Cobalt Strike and SMB distribution and achieves domain-wide encryption in 29 hours to domain-wide Ryuk, 400 locations impacted, a $6M ransom demand, and three weeks to restore some services. Practical takeaways cover backups, segmentation, monitoring, and detection of encoded PowerShell TTPs.
AI-written summary · about
chapters (5)
- 0:00Introduction to ransomware
- 1:32Trends in ransomware attacks
- 5:28Dharma ransomware case study
- 19:04Ryuk ransomware case study
- 25:36Defense and mitigation advice
related talks
21mRansomware Attack: Lessons Learned
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
52mRansomware 101: Get Smart Understanding Real Attacks
40mRansomware Threat Landscape
52mRansomware; The Real Pandemic
40mRansomware: New Recipe For An Old Dish
37mRansomware Resilience: Holistic Defense for SOC Leaders
54mExperience a simulated ransomware event: Learn now to prevail later