Stay Ahead of Ransomware Livestream

Ransomware isn’t just sticking around, it’s changing in ways that are easy to miss if you’re not watching closely. Join SANS Certified Instructors Ryan Chapman and Mari DeGrazia for our May episode as they break down what’s happening right now in the ransomware landscape and what you should be paying attention to. The goal is simple: help you stay informed and better prepared before you're dealing with it firsthand. Tune in the first Tuesday of every month to stay ahead.

For years, Initial Access in the world of Ransomware and Cyber Extortion was a battle between phishing, Remote Desktop Protocol (then just "remote access"), and software vulnerability exploitation. While those three remain key players, social engineering tactics have evolved and taken on a more substantial share of the initial access market. Ransomware campaigns are more commonly involving threats such as the ever-evolving ClickFix along with Teams-based social engineering tactics that often involve QuickAssist and/or RMM threats. Join Ryan and Mari as they walk you through example attacks, live with hands-on keyboard analysis of such attacks, and discuss tips and tricks related to prevention, detection, and response for these initial access methods.

Raymond DePalma returns to demonstrate how DFIR practitioners can build an AI agent that analyzes forensic artifacts, correlates them with real-time threat intelligence, and rapidly produces actionable incident response insights. Through a hands-on walkthrough of a simulated ransomware incident, he shows how open-source AI tools can accelerate attribution and investigation workflows in minutes, not hours.

Raymond DePalma joins Ryan Chapman and Mari DeGrazia to explore how both attackers and defenders are leveraging AI and LLMs in the evolving ransomware landscape. They discuss the challenges of attributing AI-driven activity and share practical strategies for DFIR teams to keep pace with increasingly automated adversaries.