Ransomware is no longer a single actor with a single payload. It is a supply chain. Initial access brokers sell footholds harvested by infostealers and loaders, affiliates rent tooling and leak sites from ransomware-as-a-service operators, and extortion crews increasingly skip encryption entirely in favor of data theft, regulatory pressure, and direct harassment of victims. When one brand is disrupted, its affiliates rebrand or migrate within weeks. Defending against this ecosystem requires understanding how the pieces connect, not just how a given payload behaves.
The Ransomware & Malware Track at SANS Spring Cyber Solutions Fest 2027 brings together practitioners, researchers, and solution providers to dissect the modern ransomware economy end to end. Sessions will cover the access market and the infostealer pipeline that feeds it, affiliate tradecraft from initial foothold to hypervisor and backup targeting, defense evasion including EDR tampering and abuse of legitimate tools, the shift toward encryption-less extortion, and where AI is and is not changing attacker operations. Attendees will leave with practical detection opportunities, response and recovery lessons from real incidents, and an intelligence-driven view of where to break the kill chain before data walks out the door or encryption begins.
