Racketeer Toolkit: Prototyping Controlled Ransomware Ops
Dimitry Snezhkov introduces Racketeer, a modular adversary emulation framework designed to safely simulate end-to-end ransomware operations and test SOC response.
Summary
The Need for Controlled Ransomware Simulation
While ransomware remains one of the highest-impact cyber threats facing enterprises, organizations lack safe, realistic tools to test detection pipelines and incident response playbooks.
Architecture of the Racketeer Toolkit
Dimitry Snezhkov introduces Racketeer, an open-source offensive agent and C2 framework engineered specifically for controlled extortion and encryption simulations.
Simulating Multi-Stage Extortion Campaigns Safely
Racketeer demonstrates realistic discovery, shadow copy deletion, network share discovery, and reversible cryptographic file locking with fail-safe key escrow.
Measuring SOC Detection Capabilities and IR Readiness
The author shows how red and blue teams can use Racketeer to validate EDR behavior rules, quantify MTTD/MTTR metrics, and train security operation centers.
Related talks
Red Team Village·38 min
An introduction and technical overview of CyberWraith, the Red Team Village's open-source command-and-control and engagement infrastructure platform.
Red Team Village·1 hr
Sajal Thomas
Sajal Thomas examines the technical gap between commercial red teams and state-sponsored APT groups, sharing advanced tradecraft to elevate offensive testing.
CSIT Village·24 min
Shao Xiang
Shao Xiang examines understanding the adversary mindset is essential for cyber defenders to anticipate how attackers operate and strategically strengthen defenses.