Stay Ahead of Ransomware: Hot Off the Press
Source: YouTube · SANS Digital Forensics and Incident Response · published Aug 5, 2026 · 59:55
BLUF: This episode of SANS Stay Ahead of Ransomware analyzes emerging threat actor trends, including the Killnet group’s use of Remote Monitoring and Management (RMM) tools, the rise of AI-driven "Jade Puffer" ransomware, and the value of analyzing leaked criminal infrastructure data for defensive insights. 1:45
Key Takeaways:
- Killnet’s TTPs and RMM Abuse: The Killnet ransomware group frequently abuses legitimate Remote Monitoring and Management (RMM) tools for initial access and persistence, often exploiting tools already present in environments or those deployed by Managed Service Providers (MSPs). 11:53
- Tracking Affiliates via Crypto: Effective threat actor clustering requires tracking individual affiliate behavior rather than just the RaaS brand; defenders can use cryptocurrency deposit addresses to link specific affiliates to distinct Tactics, Techniques, and Procedures (TTPs) across different ransomware families. 15:19
- AI-Generated Ransomware Artifacts: The "Jade Puffer" attack demonstrated fully automated database extortion via an AI agent; defenders can identify LLM-generated code by looking for overly consistent syntax, extensive commenting, and the use of default example wallet addresses left in the code. 31:32
- Leveraging Leaked Data: Analyzing leaked ransomware group chats and infrastructure data (such as those from the Ransom ISAC) provides actionable intelligence on specific tools (like nxc and Velociraptor) and TTPs, allowing defenders to harden environments and support disruption efforts. 48:40
Closing Statement: While AI lowers the skill barrier for attackers, fundamental cybersecurity hygiene, rigorous exposure management, and the proactive use of threat intelligence remain the most effective defenses against evolving ransomware campaigns.
Sources:
- 1:45 Introduction to the SANS Stay Ahead of Ransomware live stream and hosts.
- 11:53 Discussion of the Killnet threat actor profile and their use of RMM tools.
- 15:19 Strategies for tracking ransomware affiliates using cryptocurrency wallet addresses.
- 31:32 Analysis of the "Jade Puffer" AI-driven ransomware attack and detection indicators.
- 48:40 Discussion on using Ransom ISAC leaks to identify adversary tooling and TTPs.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] [music] [music] [music] [music] [music] >> Hello and welcome folks. My name is Ryan Chapman and I have my illustrious co-host Mary DeGrazia on with me. Mary, how you doing these days? You all right? >> wonderful. How about you, Ryan? >> I'm trying to cope with the these headphones on my head. It's throwing off everything. >> [laughter] >> I don't know how to do this with headphones. So, hello and welcome folks. This is the monthly SANS Stay Ahead of Ransomware, not behind. You don't want to get hit with ransomware or cyber extortion. We hate it. Um, at the same time, it kind of is takes over a lot of our lives and Mary and myself. We uh I'm the author of Sans forensics 528 ransomware and cyber extortion and Mary is second in charge of teaching that course. And uh I've been research…