Introduction to Identity Forensics & Incident Response (IFIR)

Making its debut in 2018, the Ryuk ransomware strand has wreaked havoc on hundreds of businesses and is responsible for one-third of all ransomware attacks that took place in 2020.

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.

Kmart's Egregor attack left its AD domain compromised, echoing Maze and Ryuk tactics: elevated AD access was abused to spread payloads—underlining the case for AD change monitoring, approval workflows and automated rollback.

Malicious PyPI builds of LiteLLM 1.82.7/1.82.8, published via a compromised maintainer account, exfiltrated API keys and system data, exposing a user's entire LLM provider surface.

Wiz examines 'malware-less' database ransomware: exposed MySQL, PostgreSQL and MongoDB servers with weak auth are looted, wiped and ransomed via native commands — no malware to detect.

Learn about the evolving ransomware landscape, including how attackers operate, the roles within the ransomware economy, and actionable strategies to strengthen your defenses.