Stay Ahead of Ransomware: From Takedowns to Hacking Back
Source: YouTube · SANS Digital Forensics and Incident Response · published Oct 7, 2026 · 1:00:29
The October 2026 SANS "Stay Ahead of Ransomware" livestream features guest Joseph Bihms explaining how law enforcement operations, sanctions, and new U.S. policy—including an NSPM authorizing vetted "hacking back"—are disrupting ransomware 1:16.
Key Takeaways:
• Ransomware keeps growing year over year, with rising data-theft extortion alongside encryption attacks 1:59.
• Operation Kronos (2024) attacked LockBit's brand—alerting affiliates the panel was seized and revealing paid victims' data wasn't deleted—sowing distrust and restricting operations 13:53.
• Operation Endgame targets the ransomware supply chain: ~326 servers down, 142 domains seized, 27M credentials recovered, €41M crypto frozen 17:00.
• OFAC sanctions add friction to ransom payments but have limits—bulletproof hosters can migrate customers elsewhere 21:42.
• The 2026 NSPM creates a narrow, government-supervised hack-back program: vetted DOJ/DHS contractors may conduct cyber operations—but only against criminal (not state-sponsored) actors, with strict approvals and a $1M bond 26:21.
• Open questions remain (attribution, deconfliction, retaliation risk), while Congress debates "cyber letters of marque" bills; implementation details expected October 11, 2026 45:42.
Government is shifting from passive defense toward offensive disruption, but these programs remain unproven works in progress.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] [music] [music] [music] [music] [music] Oh. >> [music] >> Hello and welcome folks to the October 2026 episode of the SANS stay ahead of ransomware live stream. All right, my name is Ryan Chapman. I am the SANS author for Forensics 528, Ransomware and Cyber Extortion, along with the new co-author of Forensics 610, Reverse Engineering Malware. Uh, and uh, this live stream is kind of an ode to the ever pervasive ongoing threat that is ransomware and cyber extortion. So we would love to see these particular attack styles uh you know go down and the numbers minimize over the years and rather we're seeing quite the opposite. So we're seeing the attacks just continue and continue and they grow. There's a year-over-year growth from 2024 to 25 for example. It's just crazy numbers. We're see…