Wednesday 10 December, 11am-12noon GMT

Ransomware has outgrown its reputation as a simple smash-and-grab exercise. Today, it’s a global service industry run by professionalised criminals and ambitious amateurs alike. In this session, we go inside the evolving criminal economy that fuels it, exploring how today’s attackers operate less like hackers and more like entrepreneurs. Drawing on the latest intelligence, we expose the new tactics and tradecraft emerging across the ransomware spectrum, from disciplined Russian-speaking crime syndicates running corporate-style operations to impulsive, English-speaking teens chasing clout and cash. We show what a modern “ransomware business model” looks like, how affiliates and access brokers collaborate, and why the human and cultural side of this ecosystem matters as much as the technical one. We also look at what defenders can learn from this shifting landscape and how to anticipate, rather than just react to, ransomware.

Chaired by

Liz Murray (info) The SASIG

Presented by

Rafe Pilling (info) Director of Threat Intelligence, Sophos