Build a Ransomware Sandbox with FLARE-VM and CAPE: Automated Config Extraction and IOC Dumping
Step-by-step tutorial: build an isolated ransomware analysis sandbox with FLARE-VM and CAPE, safely detonate a sample, and automate C2 config extraction…
Hunting Ransomware Pre-Encryption Behavior with Sysmon and Velociraptor: Shadow Copy Deletion, Batch Encryption, Ransom Notes
Hands-on blue team lab: simulate shadow copy deletion and mass file encryption in a VM, then hunt it with Sysmon, Velociraptor VQL, and Sigma rules.…
Build a PCAP Triage Lab with Zeek and T-Shark: Spot C2 Beacons in Real Traffic
Build a hands-on PCAP triage lab with Zeek and tshark. Extract C2 beacon intervals, JA3 fingerprints, and DNS tunnels from sample captures with verified…
Write YARA Rules That Catch Ransomware Families: A Detection Lab with yara-python
A hands-on lab teaching you how to write, test, and tune YARA rules that detect ransomware families using yara-python, real indicators, and a repeatable…
Travelex Ransomware 2020: When Sodinokibi Crippled a Currency Giant
On 31 December 2019, foreign exchange giant Travelex took its UK and international websites and mobile apps offline following a cyberattack, an outage that also knocked out white-label travel money services at ASDA, Tesco and Sainsbury’s overnight. When the story became public on 7 January 2020, the criminals behind Sodinokibi (REvil) ransomware were demanding 4.6 million pounds, claiming to have copied more than 5GB of customer data, and the company would spend weeks rebuilding systems by hand. This account reconstructs the verified timeline, the double-extortion playbook, and how the incident contributed to an August 2020 administration that cut more than a thousand UK jobs.
Ransomware at a Gas Compression Facility: CISA’s OT Alert
On 20 February 2020, CISA published AA20-030A, a joint advisory describing how ransomware had disrupted a natural gas compression facility: a phishing link let commodity ransomware spread from IT into the OT network, encrypting data historians and polling servers, severing HMI visibility, and leaving operators blind to real-time pressure and flow data for two days. The advisory became a reference model for oil and gas asset owners because it mapped, step by step, how a single email chained into loss of operational visibility without directly controlling pipeline equipment. This retrospective walks through the kill chain, the defensive gaps, and the guidance that followed.
Phishing Evolution: From Email Scams to AI-Powered Attacks
Phishing Evolution: From Email Scams to AI-Powered Attacks
Trace the evolution of phishing attacks from crude 1990s email scams to AI-powered deepfake campaigns. Discover how attackers leverage machine learning and automation to create convincing social engineering attacks.
Change Healthcare ALPHV: The Ransomware That Broke US Healthcare
One ALPHV/BlackCat intrusion in February 2024 froze claims and pharmacy payments across US healthcare for weeks — the single most consequential ransomware attack of the year. This account covers the nine-day dwell time, the $22 million ransom payment and the exit-scam double-cross that brought RansomHub back for seconds, the eventual disclosure of hundreds of millions of records, and why one processor’s central position converted a single encryptor into a national healthcare liquidity crisis.
Living Off Trusted Infrastructure: C2 via Legitimate Services
DragonForce’s Backdoor.Turn routes ransomware C2 through Microsoft Teams TURN relays using anonymous visitor tokens — LOTI, living off trusted infrastructure. Why network detection dies and what still works.
Sony’s September: Rhysida, Ransomed.vc, and Claim Triage
In September 2023 two extortion crews — Rhysida and the short-lived Ransomed.vc — both posted Sony data claims, complete with a Bitcoin auction and a leaked code-signing certificate. Sony investigated; the claimed 6TB scale never verified.
Ransomware countdown first 24 hours timeline
The First 24 Hours of a Ransomware Attack: Survival Playbook
Change Healthcare lost the claims pipeline of a nation in hours. This minute-by-minute playbook covers hour zero containment, the command structure by hour four, backup verification, pay/no-pay, regulatory clocks — and the non-technical decisions that decide survival.
CISO Guide to Ransomware Response Checklist
Ransomware Response Checklist for CISOs
CISO guide to ransomware incident response: a complete checklist covering preparation, detection, containment, eradication, and recovery phases for enterprise environments under active ransomware attacks.