The B-side that no one sees: the ransomware that never reached mainstream popularity

The talk looks at ransomware operations that stayed out of the headlines, groups that rarely collected much money or recognition. The speakers contrast them with well-known families such as LockBit and explain why these smaller crews still matter for understanding the threat landscape.

They walk through a range of examples. Hello Kitty, which leaked stolen game source code, is followed through its rebrands and the passwords and files it left behind, showing how stolen material gets recycled. Cuba and its successors illustrate how a single file and hybrid encryption can be reused across rebrands. A Hitler-themed strain is described as renaming files and showing a fake error window rather than actually encrypting anything. Commodity families such as Hermes, Chimera and Tesla Crypt are discussed as rentable builders sold on forums, with Hermes first linked to a Lazarus-attributed bank attack. The Everest group is traced through its shift from ransomware to data extortion and initial access brokering, including claims against an Argentinian government body.

The closing part turns to practical lessons: the affiliate payment model, exit scams like the one attributed to BlackCat, and the value of transparent incident disclosure. The question session covers contacting threat actors directly, initial access brokers in Latin America, and the gaps in documenting tactics for the region.