What’s Next In The Fight Against Ransomware

The talk opens with the scale of the problem. Ransomware has become more common and more profitable, with attackers adding extra extortion steps such as threatening to leak stolen data or contact customers and investors. A ransomware-as-a-service model lets affiliates rent malware and share proceeds, and cryptocurrency makes payments harder to trace. The speaker describes these groups as organized, well-funded operations that reinvest their earnings.

The middle section walks through a typical intrusion. It usually starts with phishing or a malicious link, followed by credential theft, lateral movement toward domain controllers, and data theft before encryption. Dwell times can stretch for months, and attackers may tamper with backups. Malware has also shifted from files on disk toward fileless, memory-resident techniques. The speaker compares modern ransomware gangs to historical pirates and privateers, arguing that cutting off safe havens, payment flows and recruitment may matter as much as technical controls. Backups and cyber insurance are discussed as helpful but imperfect recovery options, since paying a ransom does not guarantee full restoration.

The closing part argues for layered prevention that combines endpoint protection, behavior-based detection, and decoy canary files, with an emphasis on reducing alert fatigue for analysts. The speaker suggests insurers may begin requiring stronger defenses as a condition of coverage. For practitioners, the main takeaway is that stopping an intrusion early in the attack chain raises the cost for attackers, and that no single control is enough on its own.