Malware & ransomware

How hostile code gets in, stays, and gets paid.

24 sketches

• EDRCut the wire first
• AllowlistingNothing runs unless it is on the list
• Backup isolationLashed to the deck
• BotnetsSomebody else's hire fleet
• Command and controlThe wire under the wall
• Data exfiltrationWeigh what leaves
• Data theft extortionThe day nothing broke
• Endpoint isolationCut the wire, not the power
• Immutable backupsHeld for thirty days
• Living off the landBorrowed, not brought
• MalwareThe extra handle
• PersistencePulled, not uprooted
• RansomwareOne lever of four
• RootkitsThe answer comes from inside the room
• SandboxingIt behaves, because it can tell
• VirusesThree ways to travel
• Ransomware is often the last stage, not the firstThe bang is the end of the fuse
• Backups are ransomware targetsThe lifeboat goes first
• Lateral movement turns one foothold into manyAlong the loft, house to house
• Command and control gives malware an operatorSomebody is still holding the controller
• Persistence is about surviving changeStill there after the tide
• Living off the land reduces new-tool visibilityThey use your tools, not theirs
• Ransomware recovery is an identity problem tooThe data is the easy half
• Encryption speed is not the only ransomware impactThe clock only times the locking