Dissecting the Ransomware Kill Chain: Why Companies Need It

Kurtis Minder and Bryce Webster-Jacobsen of GroupSense open by arguing that ransomware does not fit neatly into traditional attack frameworks such as the Lockheed Martin kill chain. They describe a market where access is bought and sold, cryptocurrency makes large payments easy, and attackers often rely on simple weaknesses like exposed remote access, weak passwords and missing multi-factor authentication.

The core of the talk is a 15-step ransomware kill chain running from first access through encryption. The speakers walk through targeting, noting that some groups avoid certain regions or industries while others pursue large-revenue firms, and that attackers often follow up on successes within a sector. Later stages cover privilege escalation, searching for financial, HR and legal records that can serve as leverage, and stealing data before encryption. They point out that the most practical places to disrupt an attack are early, when access is offered for sale, and at command-and-control, though detection there often comes too late.

Beyond the network, they describe a blast radius that reaches morale, customers, public relations, legal notifications and cyber insurance. Practical guidance includes not rebooting machines or searching for quick decryptors, avoiding contact with extortionists until ready, involving legal counsel and PR early, and reading insurance terms before an incident. They also stress checking sanctions exposure and note that backups do not remove extortion risk or re-intrusion. The takeaway is to test incident response and continuity plans, keep a printed copy, and include non-technical stakeholders.