52 mins from initial access to ransomware - is your defensive team ready?
summary
Shows a real incident where attackers go from initial access to full encryption in 52 minutes from initial access to encryption, using Cobalt Strike C2, MFA phishing and MFA spamming, and rapid lateral moves to steal and exfiltrate sensitive files for double extortion. Microsoft telemetry cites median 47 minutes from breach to business down and 61% of attacks start via identity compromise. Demonstrates using Microsoft Defender 365, Sentinel, honeytokens, number‑matching MFA, automatic attack disruption and deception to detect, correlate and block at machine speed.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:14Ransomware threat landscape
- 8:13Ransomware tactics evolution
- 13:18Double extortion impacts
- 21:25Ransomware as a service
- 26:45Nation states in ransomware
- 31:41AI and threat intelligence
- 32:02Ransomware attack timeline
- 41:42Encryption speed and business impact
- 43:11Defensive recommendations
- 53:08Key takeaways
related talks
21mRansomware Attack: Lessons Learned
32mSurviving a Ransomware Attack - Lessons from the Field
55mNavigating Top Cyber Risks And Regulatory Requirements
37mRansomware Resilience: Holistic Defense for SOC Leaders
52mRansomware; The Real Pandemic
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
52mRansomware 101: Get Smart Understanding Real Attacks
37mThe top list of securing your developer workstation