Breaking Bad Actors: Transforming Threat Intelligence into RaaS Resilience

Подробнее о видео

SANS Ransomware Summit 2025

Breaking Bad Actors: Transforming Threat Intelligence into RaaS Resilience
Christina Macaire, Senior Threat Intelligence Analyst, PwC
Sohan Lokula, Senior Analyst, Threat Intelligence, PwC

Data and statistics are fundamental to understanding and combating real-world criminal activity, enabling us to extrapolate trends and proactively address emerging threats. However, this data-driven approach is often underutilized in the fight against Ransomware-as-a-Service (RaaS), despite the wealth of information available to us through leak site figures – the cyber equivalent of real-world crime data. This presentation delves into the insights available through the analysis of leak site data, going beyond surface-level observations to provide a unique perspective, augmented by PwC Global Threat Intelligence team’s own first-hand telemetry and collection, and insights from incident response engagements.

In this presentation we will explore:
• The evolving RaaS ecosystem: Moving beyond simply identifying actors, we will analyse how the landscape has transitioned towards a more fluid and agile model. This includes examining the rise of affiliate programs and the increasing speed at which new RaaS brands achieve “critical mass”, highlighting the sophisticated skills and established networks that underpin these operations.
• Shifting targets and tactics: We will dissect the evolving targeting strategies of RaaS operators, analyzing shifts in preferred sectors and countries over time. This will be enriched with insights gleaned from PwC’s incident response engagements, providing real-world context to the data trends.
• Impact of law enforcement operations: Examining the impact of increased law enforcement focus on major RaaS operations like Conti, LockBit and affiliates such as Scattered Spider, we will explore whether this pressure is driving a shift towards smaller, more agile RaaS brands. This analysis will consider the potential emergence of a “death by a thousand cuts” strategy, where operators leverage a portfolio of smaller affiliates to minimise the impact of disruptions.

By providing this in-depth analysis of leak site data, enriched with real-world insights from PwC Global Threat Intelligence’s experience, this presentation will equip attendees with actionable intelligence that they can use in defending their own networks. Attendees will gain a deeper understanding of how to leverage this data to inform both tactics and strategic decision makers in their response to the RaaS ecosystem. Ultimately, by adopting data-driven methodologies like those used in combating real-world crime, organisations can better anticipate, prioritise, and mitigate the evolving threat of ransomware.

View upcoming Summits:

#RansomwareSummit #Ransomware #ThreatIntelligence