Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Explore advanced threat hunting strategies for tracking ransomware-as-a-service (RaaS) groups in this comprehensive conference talk delivered by threat intelligence analyst John Dilgen at Recon Village during DEFCON 33. Delve into recent research examining the decline of the Black Basta operation while learning how threat intelligence teams monitor dark web forums and marketplaces to uncover emerging tactics, affiliations, and operational changes within criminal ecosystems. Discover how to leverage investigation telemetry and TTP analysis to detect evolving behaviors, understand post-disbandment shifts in membership and operations, and anticipate sophisticated cyber campaigns. Master practical methodologies for tracking threat actor activity across dark web forums and illicit marketplaces, applying structured research approaches to your own threat hunting workflows, and monitoring shifts in RaaS group membership, branding, and operating models after disbandment. Learn to use investigation telemetry for identifying and correlating new or modified TTPs across incidents and campaigns, build proactive detection strategies that anticipate advanced ransomware campaigns rather than simply reacting to them, and translate dark web and telemetry insights into actionable organizational defenses. Gain hands-on experience through live demonstrations and practical techniques that provide repeatable methodologies to enhance threat detection and response capabilities in today's rapidly changing threat landscape.
