Ransomware changes rapidly. At a technical level, attack infrastructure can change by the minute, operationally changing attack techniques while strategically targeting certain sectors, industries or regions at appropriate times.
Access brokers work across multiple groups, operators switch botnets, and malware developers continuously refine their techniques. They borrow each other’s tactics, fall out with each other and make up again.
Over the last 24 months, this activity has created a more chaotic, diverse and complex threat environment – an environment that we must monitor and learn from, to better prepare our detection and prevention tools and controls.
