Inside the Ransomware War Room | Human Side of Cybercrime with Jon DiMaggio
Source: YouTube · Prabh Nair · published Aug 26, 2026 · 41:22
Ransomware must be treated as a human adversary problem, not just malware — understanding attackers' psychology and motivations is key to stopping attacks 4:50.
Key Takeaways:
• The #1 mistake: relying solely on automated defenses — attackers are talented humans who return if the human element isn't addressed 4:50.
• Frameworks like MITRE ATT&CK and the cyber kill chain remain valuable; a 2022 technique where a group ran attacks from a VM inside a victim's network shows why knowing a group's TTPs matters 7:04.
• Human intelligence plus data yields higher-fidelity intel: trusted relationships with threat actors helped the FBI patch victims pre-attack, and knowing negotiation tricks (e.g., hidden multiple decryption keys) saves time and money 11:25.
• The speaker spent ~1.5 years profiling LockBit via a sock puppet, infiltrated their channels, and built an open relationship that helped the NCA and FBI indict its leader 17:14.
• Groups are riddled with paranoia, greed, and infighting ("a soap opera for cyber criminals") that can be exploited 22:02.
• Ransomware is an ecosystem: access brokers, affiliates, and RaaS providers share every ransom 29:20.
• AI is at "the tip of the iceberg": expect human-managed AI attack resources at greater scale within a few years 35:44.
Understanding the human behind the keyboard adds a defensive layer pure data cannot; don't wait until you've been breached to care.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
So before any kind of encryption begin who select the victim who break the network who steal the data and who finally negotiate the ransom >> there's different components to these groups where you have different sort of job roles >> and what is the challenge in this entire process when they hunting for the targets and all that >> there are some groups where all they do is they just sort of scan and look for vulnerable infrastructure and those are sort of your targets of opportunity >> when you said about the different type of affiliations and links we have and sometime what happen we don't get the complete information on the even dark web. So how can you figure out in that case? >> You're not going to be able to just figure it out by looking at what they're saying or just looking at the da…