Adapting Tradecraft - Examining Ransomware Attacks in 2024 - Insights from The DFIR Report

Explore the evolving landscape of ransomware attacks through this keynote presentation from the SANS Ransomware Summit 2025, delivered by cybersecurity experts Peter O from The DFIR Report and Angelo Violetti from Swisscom CSIRT. Gain comprehensive insights into how ransomware operators have adapted their tradecraft throughout 2024, based on real-world investigations and analysis of numerous ransomware incidents. Discover the journey of ransomware attacks from initial compromise to final impact, examining the sophisticated methods threat actors use to navigate compromised environments and deliver devastating effects. Learn about initial access techniques covering delivery mechanisms through persistence establishment, understand domain takeover strategies including lateral movement methods and attacker objectives, and analyze both common and bespoke tooling employed by ransomware groups, including living-off-the-land techniques and custom tools. Observe actual ransomware operator behavior through command-line and graphical user interface interactions, uncovering the human element behind these automated threats. Understand emerging trends in ransomware operations and develop effective defensive measures to counter these persistent threats that continue to impact organizations worldwide despite ongoing security efforts.