BSides Atlanta 2025

Where did the Threat Actor go? - They RAN-SOM-WARE...
A journey into the heart of a ransomware gang; from the trade craft used to bypass defenses,
to the anatomy of attack.

Outline:

• Intro
• Who are threat actors?
• The OG's
  • REvil
  • Conti
  • HIVE
• The Top Dogs
  • LockBit
  • ALPHV/BlackCat
  • CL0P
  • Qilin
  • Akira
  • Hunters International
  • Medusa
  • Play
  • Ransomhouse
  • Rhysida
• The rookies
  • Scattered Spider
  • Cactus
  • Everest
  • Silent
  • Stormous
  • Skira
• What motivates the bad guys?
• Money
• Politics?
• What is ransomware?
• Cryptovirology
• How does it all work?
• F#ck you, Pay me.
• Data brokers
• Who pays these people???
• Too many people
• WHY!?
• Make it stop!
• How do we stop them?
• "Only you can prevent "forest" fires..." ~ Smokey, the D.A.
• Are they here to stay?
• Organized crime is as old as time...
• Outro
• Are you ready for a ransomware attack?