It's Not Finished - The Evolving Maturity in Ransomware Operations

Explore the evolving landscape of ransomware operations in this 36-minute Black Hat conference talk. Delve into the increasing sophistication of ransomware attacks, focusing on their impact on European companies. Examine the trends of larger ransom demands, smarter attackers, and prolonged intrusions. Learn about the Rival ransomware's life cycle, including breach methods, reconnaissance, deployment techniques, and data theft strategies. Understand the multi-stage process involving enumeration, after-service, boot database manipulation, and system reboots. Gain insights into the use of tools like Cobalt Strike and the double payment tactic. Conclude with key takeaways, future predictions, and the potential targeting of edge devices in ransomware operations.

Introduction
Ransomware trends
Rival
Arrival Breach
Reconnaissance
Deploy Ransomware
Rival Ransomware
Life Cycle
How it works
catwalk
Data theft
Cobalt Strike
Double Payment
Stage 1 Enumeration
Stage 2 After Service
Stage 3 Boot Database
Stage 4 Reboot
Takeaways
Conclusions
Whats next
Edge devices