DEF CON 32 - Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panel - Vangelis Stykas

Vel Stias disrupts ransomware groups by exploiting vulnerabilities in their command-and-control infrastructure using web penetration testing and open-source threat intelligence, highlighting the growing professionalism and structure of the ransomware industry. 3:00

Key Takeaways:
• Uses web app penetration testing and CTI sources like Ransomware.lu and GitHub to identify ransomware groups such as Malo, Black Cat, and Everest 3:00.
• Exploits a reply ID parameter vulnerability in Malo’s chat to access internal messages, revealing team dynamics and decryptor details 20:01.
• Continuously scans Black Cat’s C2 servers, discovering documentation that exposed lateral movement and data exfiltration commands, leading to the interruption of a campaign targeting four cryptocurrency companies 24:00.
• A child’s observation of a misconfigured WordPress server named "vertigo" leads to unauthorized access, revealing sensitive data and enabling exploitation of a Windows 2012 server with remote command execution 31:00.
• Advocates for greater transparency in the cybersecurity community, calling for open sharing of threat data to improve collective defense and challenge the status quo without becoming a vigilante 36:40.

Stias positions himself as a "socratic fly" who challenges malicious actors ethically, emphasizing that his actions aim to disrupt criminal behavior without crossing into harmful vigilantism, and calls for stronger, more open collaboration in threat intelligence.

Sources:

• 3:00 Vel Stias discusses his use of open-source threat intelligence and web penetration test