Program Sikkerhetsfestivalen 2026

Forensics

Analyzing Ransomware Exfiltration Infrastructure

Tirsdag – 5 · Kulturhuset Banken, Kafeen

EnglishDetailed 40 min

Foredragsholder

William Thomas

William Thomas

Senior Threat Intelligence Advisor

Will Thomas is a Senior Threat Intelligence Advisor at Team Cymru with over 9 years experience in cybersecurity. He previously worked as the Head of Threat Hunting at Equinix, the world’s largest data center company, and is the co-author of the SANS FOR589 Cybercrime course and SANS Instructor. Before this, he worked for Cyjax, a CTI vendor that works with UK banks and police. He is well-known for the research on his personal blog (bushidotoken.net) and his work as the co-founder of the Curated Intel trust group. He has presented his research at various conferences including Underground Economy, DEFCON, Sleuthcon, and CyberThreatUK.

Om sesjonen

In this talk, my aim is to share how Team Cymru can track and identify upstream connectivity related to ransomware exfiltration activities via its collection of 300b+ daily NetFlow records from hundreds of ISPs around the world. Two key groups that are the focus of this talk will be Akira and Warlock. Each group's exfiltration infrastructure will be detailed in depth so that attendees can take the lessons learned and apply them to their own data sets for threat hunting, threat detection, and incident response. The talk will end with further exfiltration detection opportunities using a continuously updated and open source threat intelligence knowledge graph called the Ransomware Tool Matrix.

Samtidig i programmet

  1. Testing API Business Logic With AI Agents: What We Got Wrong First 1 · Frimurerlosjen, rom 1
  2. TeamFiltration GOes Brrr 1 · Frimurerlosjen, rom 2
  3. Internet voting in Estonia 10 · HeartBox ,Teatersalen
  4. A deeper dive in the Mjøsa uh ESA lake 10 · HeartBox, Byscenen
  5. Fra kontraktsinngåelse til exit – hvordan tilrettelegge for en gjennomførbar exit-strategi 11- Breiseth, Storlon
  6. Safety is No Longer Enough: Why Modern OT Risk Assessment Needs CyLOPA to Survive 2026 2 · Home hotel Hammer, moen nede
  7. Når risikoen er fysisk – svaret er digitalt: Navs nye verktøy for tryggere møter 2 · Home hotel Hammer, moen oppe
  8. "Du ser det ikke før du tror det" 3 · Hvelvet, Gullsalen
  9. Hvordan lykkes med tredjeparts risikostyring (TPRM)? 4 · Kommunestyresalen, Lillehammer rådhus
  10. BankID: En falsk trygghet? 5 · Kulturhuset Banken, Expedisjon
  11. Suverenitet uten digital selvskading 5 · Kulturhuset Banken, Festsalen
  12. Endringsevne i skyen: fra risiko til robusthet 5 · Kulturhuset Banken, Holbøsalen
  13. Å bygge sikkerhet fra dag en: Styringssystem og sikkerhetsorganisasjon i et nytt direktorat 6 · Lillehammer kino, sal 2
  14. Å styre det usynlige: psykososial risiko i sikkerhetsarbeidet 6 · Lillehammer kino, sal 4
  15. Når angrepet er ekte nok: Lærdom fra TIBER‑NO 9 · Victoria Scandic, sal 1+2
  16. Hvorfor deteksjonene dine suger og hva du kan gjøre med det 9 · Victoria Scandic, sal 3