Ransomware As Canary For Societal Disruption

Joe Slowik argues that ransomware is already causing the kind of disruption to hospitals, schools and other essential services that policymakers usually link to future state-directed attacks. He points to the Düsseldorf case, where an ambulance was rerouted after an attack and patient care suffered, and notes that wiper-style incidents have often done more real damage than the speculative operational technology attacks that draw most of the attention.

The middle of the talk compares the tradecraft of ransomware affiliates with that of state groups such as Volt Typhoon. Both tend to rely on stolen credentials, weak or missing multi-factor authentication, exposed edge devices and living-off-the-land techniques. Drawing on ATT&CK data, threat reports and incident analyses, he argues that this overlap means one set of controls can address both kinds of adversary. Examples include enforcing multi-factor authentication on external services, reducing exposed attack surface, improving vulnerability management and limiting administrative movement.

He closes by urging communicators to frame threats around immediate, tangible operational impact rather than distant scenarios, which may make it easier for asset owners to justify investment. He also acknowledges limits: many under-resourced organizations cannot implement these controls, so residual risk remains. Business continuity, disaster recovery and the ability to rebuild systems quickly are presented as necessary additions. In the Q&A, the discussion touched on the ecosystem of access brokers and affiliates and the value of detailed, actionable incident reporting.