Ransomware Rebranding ... So Hot Right Now!

The talk opens with the growth of ransomware activity, showing that the number of active groups rose steadily from 2022 into 2023. The speaker, a threat intelligence team lead, argues that many operators run ransomware like a business, timing their activity around cryptocurrency prices and financial incentives. He then introduces a taxonomy that sorts groups into full-time operations, rebrands, splinter groups and ephemeral groups, based on their behavior and capabilities.

The middle of the talk covers why groups rebrand, usually after drawing heavy law enforcement attention or damaging publicity, and what the move gains them. Case studies trace one group through several names with shrinking gaps between rebrands, and another whose overlapping variants suggested simultaneous operations. A separate case linked two groups only through a shared email address, found after intelligence sharing with the FBI, despite little similarity in their encryptors. Attribution methods include comparing recurring code routines and coding style, along with behavioral signals such as initial access techniques, negotiation patterns, payment handling and relationships between groups. The speaker cautions that leaked builders and freelance developers can produce false attributions.

The closing section recommends maintaining a living threat profile and sharing intelligence with internal teams in a prioritized, consumable form, then feeding findings into threat models and hunting. Defensive advice centers on a tested incident response plan and fundamentals such as endpoint detection and layered defenses. The takeaway is that collaboration with peers, information sharing groups and law enforcement is how defenders can raise the cost of rebranding.