Loucif Kharouni Trend Micro
download slides (PDF)
Ransomware is a kind of malware that withholds some digital asset from the victim and asks for payment in order to release it back. This trend of attacks started in Russia back in 2005-2006 and has been changing tactics and targets since then. The last wave of attacks is targeting users in a very specific way by geo-locating the victims and confronting them with their own country's regional Police Forces, meanwhile their whole computer is being held captive.
We have been analysing this attack since it started and are now able to show some of our conclusions in this investigation. The mix of well-tuned social engineering plus an advanced networking model show that their creators are as well organized as they are persistent and creative. This is a technical talk and even though we'll also be talking about this malware from a high level perspective, we'll dig into the specifics found in this investigation, such as the money trail and how the companies involved are trying to tackle it.
