Resources

Tabletop exercises (TTXs) are an essential tool in building an organization’s resilience to cyber threats, providing a controlled environment to simulate potential incidents. These exercises allow teams to test their responses, evaluate procedures, and identify gaps in their crisis management plans. However, simply going through the motions isn’t enough to ensure preparedness—effective TTXs must strike a balance between realism, adaptability, and learning outcomes.

In one of my recent TTX sessions, I introduced a new dynamic by priming AI to provide real-time injects, adding a level of unpredictability and immersion to the exercise. The result was a more engaging and challenging experience for the participants, ultimately improving their response planning. In this blog, I’ll discuss the elements that make a TTX effective and highlight the benefits of using AI for injects in real-time scenarios.

Cybersecurity professionals have been keeping a close eye on the shake-ups in ransomware over the past few weeks. While many ransomware victims believe they are dealing with highly sophisticated threat actors, these cyber criminals are often one argument away from collapse. CEO Kurtis Minder was featured in the Axios Codebook Newsletter last week discussing the ongoing ransomware attack carried out by ALPHV on healthcare giant Change Healthcare. Learn more from the excerpt below or read the full article here.

Healthcare giant UnitedHealth could take months to get their data back after being attacked by ransomware gang ALPHV. With such a large amount of data, it can be very difficult to get decryption keys working—especially if you're dealing with a tough threat actor group. CEO Kurtis Minder was featured in Reuters speaking on GroupSense's experience negotiating with ALPHV in the past. Check out the excerpt below or view the full article here. 

Ransomware gang ALPHV, also known as BlackCat, went dark after attacking Change Healthcare with ransomware. They asked for a $22 million payment from the healthcare organization, and then posted a seemingly fake FBI seizure notification on their website. Fishy, right? GroupSense CEO Kurtis Minder was featured in an article on CyberScoop talking about the high ransom and its impact on organizations trying to get operational after an attack. Check out the excerpt below or read the full article here.

Just one week after the takedown of the LockBit ransomware group, it appears their servers are back online. While law enforcement seized their shame site, they appear to have missed LockBit's backup servers, allowing the group to be operational quickly. GroupSense CEO was featured in DarkReading to speak on the group's leader. Read the excerpt below or get the full article here.

In the ever-evolving landscape of cyber threats, a new type of attack has emerged: dual ransomware attacks. This malevolent technique involves cyber criminals launching not one, but two ransomware attacks on a single target. The first attack serves as a distraction, often relatively easy to detect, while the second attack remains hidden and wreaks havoc behind the scenes. This double-edged approach presents a significant challenge to organizations, as it requires them to not only identify and respond to the initial ransomware attack but also uncover the covert second attack. The rise of dual ransomware attacks highlights the need for organizations to bolster their cybersecurity defenses and adopt a multi-layered approach to protect against sophisticated and relentless threats.

GroupSense CEO Kurtis Minder was featured in the Tuesday, November 7 issue of the Axios Codebook Newsletter. The "1 big thing" section is focused on the government's statement on not paying ransoms. Check out the excerpt below, and check out the full newsletter here.

Driving the news: A group of 48 governments, as well as the European Union and Interpol, signed a pledge last week to not pay hackers if their systems are hit with a ransomware attack.

• The commitment, which was made as part of last week's U.S.-led Counter Ransomware Initiative meeting, also strongly discouraged "anyone from paying a ransomware demand," including private sector organizations and organizations responsible for critical infrastructure.

The intrigue: In some cases, the larger ransomware volumes are working to victims' advantage, Minder said.

• In a handful of cases, Minder said, he's seen some ransomware gangs target so many companies that they forget who they're extorting and never return to negotiations over a payment and never leak the data they stole.

Yes, but: Without some larger enforcement mechanism or incentive program, banning ransom payments across the private sector is never going to work, Minder said.

• "Even if you made this illegal, the ransom would still be made," he said. "They just would be largely swept under the rug, or underground. It wouldn't achieve your goal."

Contrary to popular belief, a new report out of the UK shows that cyber insurers don't drive up the cost of ransom payments. The report by RUSI states that cyber insurance is not fueling the ransomware epidemic or instilling any ransom discipline. 

Moving beyond encryption is a huge part of what GroupSense ransomware negotiators do during a ransomware incident. A successful negotiation has many complex elements. The trickiest part of ransomware incidents is usually threat actor engagement. 

GroupSense Director of Intelligence Operations Bryce Webster-Jacobsen and Senior Intelligence Analyst Sean Jones presented at this year's SANS Ransomware Summit. During their session, "Beyond Encryption: Exploring the Tactics Ransomware Operators use During Negotiations and their Impact," Bryce and Sean explore the specifics of what makes threat actor engagement so complex. 

Ransomware attacks have become increasingly common in today's digital landscape. The threat posed by these attacks can be severe, ranging from the loss of sensitive data to enormous financial burdens. It's essential to understand the importance of ransomware negotiation services and how they help organizations that have fallen victim to these attacks. This article presents a comprehensive buyer's guide for ransomware negotiation services to help you make informed decisions about these critical services.