Yesterday at Black Hat MEA, my first deep dive session of the day focused on “Ransomware as a Service (RaaS) from code to cartel”.
I was privileged to share the stage with Ira Winkler, Patricia Titus, and Bjørn R. Watne.
We explored the evolution of ransomware into today’s organized, profit-centered, multi-disciplinary threat collectives, and delved into some key areas such as:
- The affililiate model and how ransomware groups function like legitimate companies
- Recruitment for capabilities (e.g., exploit developers, cloud security engineering, C2 servers, payment portals, compromise of trusted insiders, etc.)
- The importance of business resilience as a risk response (e.g., disaster recovery testing, incident response planning, ransomware playbooks, tabletop exercises)
- How the transition from double extortion to triple extortion is also manifesting as threats of bodily harm and targeting of family members
- Emphasized that cyber insurance is not a replacement for robust security controls (e.g., air-gapped backups, MFA, PAM, EDR, security awareness, etc.)
- How critical infrastructure protection (CIP) and operational resilience legislation factor into the overall industry response (e.g., DORA, NIS 2, CRA, etc.)
- Detailed why software developers and their tooling are increasingly targeted by RaaS consortiums due to risks such as privileged access to sensitive environments (staging, production), API and cloud infrastructure key custodianship, DevSecOps weaknesses, trust injection across CI/CD pipelines, code repository theft, etc.
- Addressing encryption-related risks like quantum computing and cryptographic agility
- How both defenders and attackers are leveraging AI
Many thanks to my fellow panelists for their brilliant insights and a note of appreciation for all those who attended.
Niel Harper 