WEBVTT
00:00:00.430 --> 00:00:03.649
Last year, ransomware crews launched about 50
00:00:03.649 --> 00:00:08.070
% more attacks and made 8 % less money. The locks
00:00:08.070 --> 00:00:11.150
stopped paying, so they stopped using it. In
00:00:11.150 --> 00:00:15.250
2026, 94 % of ransomware cases involved stealing
00:00:15.250 --> 00:00:18.769
your data and only 68 % even bothered to encrypt
00:00:18.769 --> 00:00:21.989
it. Welcome to the exfiltration era where your
00:00:21.989 --> 00:00:24.030
backups don't save you because the threat was
00:00:24.030 --> 00:00:27.030
never about locking your files. This is tech
00:00:27.030 --> 00:00:30.579
updates. Here's the shift in one sentence. For
00:00:30.579 --> 00:00:33.359
a decade, ransomware meant your files got encrypted
00:00:33.359 --> 00:00:36.740
and you paid for the key. Now the crews increasingly
00:00:36.740 --> 00:00:39.380
skip the encryption entirely. They just steal
00:00:39.380 --> 00:00:42.079
everything and threaten to leak it. Coveware,
00:00:42.500 --> 00:00:44.920
which handles thousands of these cases, says
00:00:44.920 --> 00:00:47.799
data theft is now the default and encryption
00:00:47.799 --> 00:00:51.759
is optional. Why drop the encryption? It's faster.
00:00:52.119 --> 00:00:55.140
It's quieter. No noisy crypto routine to trip
00:00:55.140 --> 00:00:58.659
your EDR. There's no decrypter to build and maintain,
00:00:58.939 --> 00:01:01.859
and crucially, a clean backup is useless when
00:01:01.859 --> 00:01:05.519
the threat is publication, not lockout. You can
00:01:05.519 --> 00:01:08.120
restore your servers. You can't unleash your
00:01:08.120 --> 00:01:11.920
customer data. One stat before we move on. Crypto
00:01:11.920 --> 00:01:14.900
payments to ransomware crews fell to roughly
00:01:14.900 --> 00:01:20.200
$820 million last year, down about 8%, even as
00:01:20.200 --> 00:01:23.500
a tax hit a record high. Read that again. More
00:01:23.500 --> 00:01:26.480
attacks, less money. The share of victims who
00:01:26.480 --> 00:01:29.359
pay has crashed to record lows. And here's a
00:01:29.359 --> 00:01:31.560
teaching moment because the exact number depends
00:01:31.560 --> 00:01:34.920
on who's counting. Chainalysis says about 28
00:01:34.920 --> 00:01:39.099
percent. Coveware says closer to 20. Sophos,
00:01:39.219 --> 00:01:43.079
surveying companies directly, says 48. Same trend,
00:01:43.500 --> 00:01:46.000
different lenses. And knowing why those numbers
00:01:46.000 --> 00:01:49.299
disagree is half of reading a threat report like
00:01:49.299 --> 00:01:52.189
a pro. The point stands, paying is no longer
00:01:52.189 --> 00:01:54.730
the default. But here's the twist that makes
00:01:54.730 --> 00:01:57.730
this smarter than the average take. Exfiltration
00:01:57.730 --> 00:02:00.890
only is the dominant tactic, and it is not a
00:02:00.890 --> 00:02:03.950
guaranteed payday. When crews mass steal data
00:02:03.950 --> 00:02:06.930
and demand money, victims are increasingly calling
00:02:06.930 --> 00:02:10.169
the bluff. One big exfiltration campaign saw
00:02:10.169 --> 00:02:13.780
an estimated 2 .5 % pay rate. Two and a half.
00:02:14.259 --> 00:02:16.939
So this isn't crews getting richer, it's crews
00:02:16.939 --> 00:02:19.639
getting cheaper and stealthier to run, while
00:02:19.639 --> 00:02:22.960
their leverage erodes. It's an arms race, not
00:02:22.960 --> 00:02:26.780
a slam dunk. The lesson. Your data being stolen
00:02:26.780 --> 00:02:29.840
is a disclosure event whether or not you pay.
00:02:30.439 --> 00:02:33.800
So plan for the leak, not just the ransom. Who's
00:02:33.800 --> 00:02:37.500
actually doing this in 2026? The board reshuffled
00:02:37.500 --> 00:02:40.599
hard. Lockbit got crippled by law enforcement
00:02:40.599 --> 00:02:43.509
and never recovered. The post -lockbit leader
00:02:43.509 --> 00:02:46.569
Ransom Hub went dark last spring and its affiliates
00:02:46.569 --> 00:02:50.250
scattered. Filling the vacuum, Akira and Keelin,
00:02:50.550 --> 00:02:54.189
each running roughly 16 % of attacks, with Klopp
00:02:54.189 --> 00:02:57.090
as the pure data theft specialist, mass zero
00:02:57.090 --> 00:03:00.050
-day campaigns, no encryptor at all. And the
00:03:00.050 --> 00:03:02.770
crews from our breach episode, scattered spider,
00:03:03.050 --> 00:03:06.069
shiny hunters, merged and launched their own
00:03:06.069 --> 00:03:09.370
ransomware as a service. The help desk Social
00:03:09.370 --> 00:03:12.560
Engineers became the platform vendors. The market
00:03:12.560 --> 00:03:15.580
consolidated. The top 10 groups now account for
00:03:15.580 --> 00:03:19.719
about 70 % of victims. And yes, AI is in the
00:03:19.719 --> 00:03:22.759
loop now. Anthropic disclosed a case last summer
00:03:22.759 --> 00:03:25.319
where a single operator used Claude Code to run
00:03:25.319 --> 00:03:28.340
an extortion campaign against 17 organizations.
00:03:29.000 --> 00:03:33.000
The AI doing reconnaissance, exploitation, and
00:03:33.000 --> 00:03:36.580
writing the ransom notes. One person, one AI
00:03:36.580 --> 00:03:41.319
tool, 17 victims. Separately, an amateur used
00:03:41.319 --> 00:03:45.120
AI to build working ransomware that hit 85 targets
00:03:45.120 --> 00:03:48.360
in his first month. AI isn't just speeding up
00:03:48.360 --> 00:03:51.240
the pros. It's lowering the floor so anyone can
00:03:51.240 --> 00:03:54.340
play. And the clock is brutal. The average time
00:03:54.340 --> 00:03:57.219
from a vulnerability going public to being exploited
00:03:57.219 --> 00:04:01.199
collapsed from about 700 days in 2020 to 44 days
00:04:01.199 --> 00:04:04.449
last year. Patch windows are closing. So how
00:04:04.449 --> 00:04:07.189
do you defend when the threat is theft, not encryption?
00:04:07.710 --> 00:04:12.389
Four moves. One, watch the exits. Egress monitoring
00:04:12.389 --> 00:04:15.590
and data loss prevention catch the actual exfiltration,
00:04:16.029 --> 00:04:18.970
the bulk transfer leaving your network. Backups
00:04:18.970 --> 00:04:22.170
won't, because backups restore files, not secrets.
00:04:22.970 --> 00:04:26.649
Two, segment the network. Limit how far one foothold
00:04:26.649 --> 00:04:29.970
can reach and how much it can grab. Three, kill
00:04:29.970 --> 00:04:33.180
the entry point. phishing -resistant MFA and
00:04:33.180 --> 00:04:36.779
passkeys, plus governance over OAuth app connections,
00:04:37.180 --> 00:04:39.199
because the breach wave got in through consent
00:04:39.199 --> 00:04:42.319
screens, not cracked passwords, and hardened
00:04:42.319 --> 00:04:46.899
the help desk with callback verification. 4.
00:04:47.220 --> 00:04:50.480
Keep immutable offline backups anyway, because
00:04:50.480 --> 00:04:53.100
the crews that still encrypt, like Akira and
00:04:53.100 --> 00:04:56.100
Killen, are very much still out there. For the
00:04:56.100 --> 00:04:58.959
Security Plus crowd, map this to the incident
00:04:58.959 --> 00:05:02.470
response lifecycle. preparation, detection and
00:05:02.470 --> 00:05:06.050
analysis, containment, eradication, recovery,
00:05:06.589 --> 00:05:09.550
lessons learned. The exfiltration era shifts
00:05:09.550 --> 00:05:14.050
the weight to two phases. Preparation, your DLP,
00:05:14.430 --> 00:05:18.250
segmentation, MFA, and an IR plan that loops
00:05:18.250 --> 00:05:21.410
in legal and communications because a data leak
00:05:21.410 --> 00:05:24.250
is a reportable breach with regulators and customers
00:05:24.250 --> 00:05:27.389
attached. And detection, you have to catch the
00:05:27.389 --> 00:05:30.029
data leaving, not just the moment files get locked.
00:05:30.250 --> 00:05:33.470
Memorize this line for the exam. And for real
00:05:33.470 --> 00:05:36.810
life, a confirmed data theft is a reportable
00:05:36.810 --> 00:05:40.089
breach, encrypted or not. Here's the close. The
00:05:40.089 --> 00:05:42.430
ransom note used to say we locked your files.
00:05:42.949 --> 00:05:46.009
Now it says we have your data and will tell the
00:05:46.009 --> 00:05:48.910
world. Backups were the answer to the old threat.
00:05:49.470 --> 00:05:52.430
They're necessary and no longer sufficient against
00:05:52.430 --> 00:05:55.110
the new one. Stop the data from leaving and you've
00:05:55.110 --> 00:05:57.129
taken away the only leverage they have left.
00:05:57.600 --> 00:06:00.279
That's the show, and that wraps our July run.
00:06:00.779 --> 00:06:03.439
Next week we close it out in Las Vegas. Hacker
00:06:03.439 --> 00:06:05.839
Summer Camp, where the whole industry's reckoning
00:06:05.839 --> 00:06:08.399
with AI plays out live. This is Tech Updates.
00:06:08.579 --> 00:06:09.079
Stay sharp.
00:00:00.430 --> 00:00:03.649
Last year, ransomware crews launched about 50
00:00:03.649 --> 00:00:08.070
% more attacks and made 8 % less money. The locks
00:00:08.070 --> 00:00:11.150
stopped paying, so they stopped using it. In
00:00:11.150 --> 00:00:15.250
2026, 94 % of ransomware cases involved stealing
00:00:15.250 --> 00:00:18.769
your data and only 68 % even bothered to encrypt
00:00:18.769 --> 00:00:21.989
it. Welcome to the exfiltration era where your
00:00:21.989 --> 00:00:24.030
backups don't save you because the threat was
00:00:24.030 --> 00:00:27.030
never about locking your files. This is tech
00:00:27.030 --> 00:00:30.579
updates. Here's the shift in one sentence. For
00:00:30.579 --> 00:00:33.359
a decade, ransomware meant your files got encrypted
00:00:33.359 --> 00:00:36.740
and you paid for the key. Now the crews increasingly
00:00:36.740 --> 00:00:39.380
skip the encryption entirely. They just steal
00:00:39.380 --> 00:00:42.079
everything and threaten to leak it. Coveware,
00:00:42.500 --> 00:00:44.920
which handles thousands of these cases, says
00:00:44.920 --> 00:00:47.799
data theft is now the default and encryption
00:00:47.799 --> 00:00:51.759
is optional. Why drop the encryption? It's faster.
00:00:52.119 --> 00:00:55.140
It's quieter. No noisy crypto routine to trip
00:00:55.140 --> 00:00:58.659
your EDR. There's no decrypter to build and maintain,
00:00:58.939 --> 00:01:01.859
and crucially, a clean backup is useless when
00:01:01.859 --> 00:01:05.519
the threat is publication, not lockout. You can
00:01:05.519 --> 00:01:08.120
restore your servers. You can't unleash your
00:01:08.120 --> 00:01:11.920
customer data. One stat before we move on. Crypto
00:01:11.920 --> 00:01:14.900
payments to ransomware crews fell to roughly
00:01:14.900 --> 00:01:20.200
$820 million last year, down about 8%, even as
00:01:20.200 --> 00:01:23.500
a tax hit a record high. Read that again. More
00:01:23.500 --> 00:01:26.480
attacks, less money. The share of victims who
00:01:26.480 --> 00:01:29.359
pay has crashed to record lows. And here's a
00:01:29.359 --> 00:01:31.560
teaching moment because the exact number depends
00:01:31.560 --> 00:01:34.920
on who's counting. Chainalysis says about 28
00:01:34.920 --> 00:01:39.099
percent. Coveware says closer to 20. Sophos,
00:01:39.219 --> 00:01:43.079
surveying companies directly, says 48. Same trend,
00:01:43.500 --> 00:01:46.000
different lenses. And knowing why those numbers
00:01:46.000 --> 00:01:49.299
disagree is half of reading a threat report like
00:01:49.299 --> 00:01:52.189
a pro. The point stands, paying is no longer
00:01:52.189 --> 00:01:54.730
the default. But here's the twist that makes
00:01:54.730 --> 00:01:57.730
this smarter than the average take. Exfiltration
00:01:57.730 --> 00:02:00.890
only is the dominant tactic, and it is not a
00:02:00.890 --> 00:02:03.950
guaranteed payday. When crews mass steal data
00:02:03.950 --> 00:02:06.930
and demand money, victims are increasingly calling
00:02:06.930 --> 00:02:10.169
the bluff. One big exfiltration campaign saw
00:02:10.169 --> 00:02:13.780
an estimated 2 .5 % pay rate. Two and a half.
00:02:14.259 --> 00:02:16.939
So this isn't crews getting richer, it's crews
00:02:16.939 --> 00:02:19.639
getting cheaper and stealthier to run, while
00:02:19.639 --> 00:02:22.960
their leverage erodes. It's an arms race, not
00:02:22.960 --> 00:02:26.780
a slam dunk. The lesson. Your data being stolen
00:02:26.780 --> 00:02:29.840
is a disclosure event whether or not you pay.
00:02:30.439 --> 00:02:33.800
So plan for the leak, not just the ransom. Who's
00:02:33.800 --> 00:02:37.500
actually doing this in 2026? The board reshuffled
00:02:37.500 --> 00:02:40.599
hard. Lockbit got crippled by law enforcement
00:02:40.599 --> 00:02:43.509
and never recovered. The post -lockbit leader
00:02:43.509 --> 00:02:46.569
Ransom Hub went dark last spring and its affiliates
00:02:46.569 --> 00:02:50.250
scattered. Filling the vacuum, Akira and Keelin,
00:02:50.550 --> 00:02:54.189
each running roughly 16 % of attacks, with Klopp
00:02:54.189 --> 00:02:57.090
as the pure data theft specialist, mass zero
00:02:57.090 --> 00:03:00.050
-day campaigns, no encryptor at all. And the
00:03:00.050 --> 00:03:02.770
crews from our breach episode, scattered spider,
00:03:03.050 --> 00:03:06.069
shiny hunters, merged and launched their own
00:03:06.069 --> 00:03:09.370
ransomware as a service. The help desk Social
00:03:09.370 --> 00:03:12.560
Engineers became the platform vendors. The market
00:03:12.560 --> 00:03:15.580
consolidated. The top 10 groups now account for
00:03:15.580 --> 00:03:19.719
about 70 % of victims. And yes, AI is in the
00:03:19.719 --> 00:03:22.759
loop now. Anthropic disclosed a case last summer
00:03:22.759 --> 00:03:25.319
where a single operator used Claude Code to run
00:03:25.319 --> 00:03:28.340
an extortion campaign against 17 organizations.
00:03:29.000 --> 00:03:33.000
The AI doing reconnaissance, exploitation, and
00:03:33.000 --> 00:03:36.580
writing the ransom notes. One person, one AI
00:03:36.580 --> 00:03:41.319
tool, 17 victims. Separately, an amateur used
00:03:41.319 --> 00:03:45.120
AI to build working ransomware that hit 85 targets
00:03:45.120 --> 00:03:48.360
in his first month. AI isn't just speeding up
00:03:48.360 --> 00:03:51.240
the pros. It's lowering the floor so anyone can
00:03:51.240 --> 00:03:54.340
play. And the clock is brutal. The average time
00:03:54.340 --> 00:03:57.219
from a vulnerability going public to being exploited
00:03:57.219 --> 00:04:01.199
collapsed from about 700 days in 2020 to 44 days
00:04:01.199 --> 00:04:04.449
last year. Patch windows are closing. So how
00:04:04.449 --> 00:04:07.189
do you defend when the threat is theft, not encryption?
00:04:07.710 --> 00:04:12.389
Four moves. One, watch the exits. Egress monitoring
00:04:12.389 --> 00:04:15.590
and data loss prevention catch the actual exfiltration,
00:04:16.029 --> 00:04:18.970
the bulk transfer leaving your network. Backups
00:04:18.970 --> 00:04:22.170
won't, because backups restore files, not secrets.
00:04:22.970 --> 00:04:26.649
Two, segment the network. Limit how far one foothold
00:04:26.649 --> 00:04:29.970
can reach and how much it can grab. Three, kill
00:04:29.970 --> 00:04:33.180
the entry point. phishing -resistant MFA and
00:04:33.180 --> 00:04:36.779
passkeys, plus governance over OAuth app connections,
00:04:37.180 --> 00:04:39.199
because the breach wave got in through consent
00:04:39.199 --> 00:04:42.319
screens, not cracked passwords, and hardened
00:04:42.319 --> 00:04:46.899
the help desk with callback verification. 4.
00:04:47.220 --> 00:04:50.480
Keep immutable offline backups anyway, because
00:04:50.480 --> 00:04:53.100
the crews that still encrypt, like Akira and
00:04:53.100 --> 00:04:56.100
Killen, are very much still out there. For the
00:04:56.100 --> 00:04:58.959
Security Plus crowd, map this to the incident
00:04:58.959 --> 00:05:02.470
response lifecycle. preparation, detection and
00:05:02.470 --> 00:05:06.050
analysis, containment, eradication, recovery,
00:05:06.589 --> 00:05:09.550
lessons learned. The exfiltration era shifts
00:05:09.550 --> 00:05:14.050
the weight to two phases. Preparation, your DLP,
00:05:14.430 --> 00:05:18.250
segmentation, MFA, and an IR plan that loops
00:05:18.250 --> 00:05:21.410
in legal and communications because a data leak
00:05:21.410 --> 00:05:24.250
is a reportable breach with regulators and customers
00:05:24.250 --> 00:05:27.389
attached. And detection, you have to catch the
00:05:27.389 --> 00:05:30.029
data leaving, not just the moment files get locked.
00:05:30.250 --> 00:05:33.470
Memorize this line for the exam. And for real
00:05:33.470 --> 00:05:36.810
life, a confirmed data theft is a reportable
00:05:36.810 --> 00:05:40.089
breach, encrypted or not. Here's the close. The
00:05:40.089 --> 00:05:42.430
ransom note used to say we locked your files.
00:05:42.949 --> 00:05:46.009
Now it says we have your data and will tell the
00:05:46.009 --> 00:05:48.910
world. Backups were the answer to the old threat.
00:05:49.470 --> 00:05:52.430
They're necessary and no longer sufficient against
00:05:52.430 --> 00:05:55.110
the new one. Stop the data from leaving and you've
00:05:55.110 --> 00:05:57.129
taken away the only leverage they have left.
00:05:57.600 --> 00:06:00.279
That's the show, and that wraps our July run.
00:06:00.779 --> 00:06:03.439
Next week we close it out in Las Vegas. Hacker
00:06:03.439 --> 00:06:05.839
Summer Camp, where the whole industry's reckoning
00:06:05.839 --> 00:06:08.399
with AI plays out live. This is Tech Updates.
00:06:08.579 --> 00:06:09.079
Stay sharp.
