Turn and Face the Strange: Ch-Ch-Changes in Ransomware Techniques

The talk looks at how ransomware operators have changed their tools and tactics over the past few years, and which of those changes paid off. The speaker, a malware analyst and reverse engineer on a threat intelligence team, groups the shifts into themes: spreading through built-in administrative features rather than custom tooling, newer languages such as Rust and Go, Arm lockers aimed at network storage devices, and harsher extortion such as contacting victims' clients and printing ransom notes on local printers.

Several case studies follow. Play ransomware added return-oriented programming and garbage-code obfuscation a couple of months after its first samples appeared, while the underlying code stayed largely the same. ALPHV's Rust build produced lockers for several platforms and per-victim access tokens that protected negotiation chats. Its morph obfuscation toolkit inflated binary sizes and left name fragments that hinted at original function names. Other groups undermined themselves with encryption flaws, lockers that encrypted running virtual machines, and decryptors that failed on large files. LockBit Black reused leaked builder code, and a false flag claiming Chinese ties fell apart when chat logs showed Russian and a Linux variant matched a known REvil tool.

The closing advice for defenders is to hunt for the mistakes and artifacts that automation leaves behind. These include custom-written obfuscation, unusual string or mutex names, ransom note phrasing reused across platforms, odd combinations of anti-analysis checks, and flawed crypto implementations. Code overlap between families and watching affiliate forum announcements can also help link new samples to known groups.