State of Ransomware Settlements | FortiGuardLIVE

### Overview In this episode of FortiGuardLIVE, Derek Manky (VP of Global Threat Intelligence at Fortinet's FortiGuard Labs) and Aomar Marrakchi discuss the evolving landscape of ransomware settlements, criminal business models, and defensive strategies. Reflecting on over a decade of tracking ransomware since 2010, the speakers explore how attackers have transitioned from broad opportunism to highly organized, selective enterprise models targeting massive multi-million-dollar payouts.

### Key Topics - **Evolution of Extortion and Wipers**: Ransomware playbooks have advanced beyond double and triple extortion into incorporating wipers. Previously confined primarily to Advanced Persistent Threat (APT) operations, wipers are increasingly leveraged by ransomware gangs to hinder post-incident forensic investigation by destroying evidence, as well as serving as intimidation to compel victims into paying. - **Cryptocurrency Preferences**: Threat actors have largely shifted away from privacy-focused coins like Monero in favor of Bitcoin. While Monero offers built-in privacy, liquidating millions of dollars is difficult. Bitcoin provides broader liquidity, easier settlement access for victims paying seven-to-eight-figure ransoms, and simpler conversion and money laundering pipelines into real-world currency. - **Ransomware-as-a-Service (RaaS) Business Model**: The operational model has evolved from a pay-per-install (PPI) approach with thousands of unvetted actors to a pay-per-purchase (PPP) commission model. RaaS core operators now curate exclusive networks of vetted, skilled affiliates who receive the majority share of ransoms. These affiliates focus on high-value targets demanding seven- to eight-figure ransoms, leaving lower six-figure demands behind. - **Diversified Distribution Vectors**: Ransomware deployment is increasingly distributed through an array of initial access vectors, including botnets, website and CMS plugins (such as WordPress plugins), ad networks, phishing campaigns, and macro-enabled office documents.

### Technical Details Defending against contemporary ransomware requires mapping and disrupting complex attacker infrastructure rather than solely focusing on malware binaries. Infrastructure encompasses initial delivery mechanisms, vetted affiliate portals, command-and-control (C2) servers, money mule systems, and laundering networks. Proactive defenses highlight multi-layered prevention—incorporating endpoint security, web filtering, DNS filtering, and integrating threat intelligence into AI/ML-driven detection models to stop intrusions before encryption or data wiping begins.

### Takeaways - **Incident Response as an Ongoing Practice**: Organizations should maintain active, tested incident response plans that adapt continuously to modern ransomware trends, including wiper recovery and antiforensic tactics, rather than treating incident response as a reactive measure activated only during a crisis. - **Proactive 'Shift Left' Defense**: Given that ransomware settlements now reach tens of millions of dollars, the return on investment (ROI) heavily favors proactive defense and automation (AI-powered SecOps) to intercept threats early. - **Technology Combined with People**: Robust security posture relies on modern orchestration, automation, AI integration, and continuous training, recognizing that human defenders alone are too slow to keep pace with dynamic cybercriminal syndicates.