From RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
Channel: FIRST
Date: 17/06/2021

Speaker: Fernando Merces (Trend Micro, BR)

Ransomware gangs are becoming more and more advanced recently. Gone are the days when you can hope for a flaw in their encryption setup that would allow for creation of a decryption tool. C&C servers are cleverly designed in bullet-proof hostings. When combined with highly targeted attacks and the new added extortion of data leakage, defending against modern ransomware gangs is an extremely difficult task. In this talk we’ll examine the details of techniques, tactics and procedures of a ransomware gang active since at least March, 2020 that despite of some OPSEC failures, still manages to put literally at least 100 billion dollars of revenue at risk. We'll share the developments of the current investigations, trends and tools they use to compromise networks and victimize companies worldwide. Using this group as case study for this entire trend, you’ll learn how groups like this operate, which tools they use, for which purpose, what to expect from this model and what weaknesses points should be strengthen to better defend your company against similar ransomware groups models.

About the Speaker
Fernando is a Senior Threat Researcher at Trend Micro, where he acts a cybercrime investigator making use of reverse engineering and threat intelligence skills to research on cyber attacks. He's also the creator of some open source security tools and runs a non-profit organization to teach security and low level programming in Brazil.