Ransomware
Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.
Search & Discovery 2.0
Find the exact control, technique, lesson, or book.
Search the complete Bare Metal Cyber knowledge system with identifier-aware ranking, framework filters, topic discovery, and direct paths into books, podcasts, and Academy learning.
11,003searchable records
6,025Academy lessons
6framework families
144published books
Search results
63 results for “ransomware”
Ransomware Resilience
Reduce ransomware entry and spread, protect recoverability, detect destructive activity, contain impact, and restore trusted operations.
Ransomware Warfare: Advanced Tactics for Ransomware Response
In this episode of BareMetalCyber, we dive into the evolving world of ransomware—breaking down how these attacks have transformed from simple lock-and-pay schemes into sophisticated, organized operations. I’ll walk you through the latest tactics used by ransomware groups, including double extortion, ransomware-as-a-service (RaaS), and highly targeted attacks that cripple businesses. You’ll also learn about the most…
Ransomware, Malware, and Password Attacks
Malicious software remains one of the most common and destructive threats to networks and users alike. In this episode, we examine different types of malware, focusing on ransomware, spyware, and trojans—each with unique goals and attack vectors.…
Ransomware Communications
Ransomware communications coordinates internal updates, leadership decisions, legal and law-enforcement engagement, customer messaging, and any authorized adversary contact.
Backup Betrayal: Ransomware vs. Recovery Plans No One Tested
The war room is already crowded when someone says the line every security leader dreads: “It’s fine, we’ll just restore from backup.” Laptops are open, the ransomware note is on screen, and the business has already started asking for recovery time estimates.
Backup Betrayal: Ransomware vs. Recovery Plans No One Tested
This narrated edition of “Backup Betrayal: Ransomware vs. Recovery Plans No One Tested” walks you through the moment every security leader fears: when “we have backups” collides with a real ransomware incident. You will hear how seemingly healthy backup dashboards hide untested assumptions, why modern attackers deliberately aim at backup and recovery infrastructure, and how that changes the real risk picture for…
Differentiate Attack Types: Ransomware, BEC, DDoS, and Data Theft (Task 1)
Listen to Differentiate Attack Types: Ransomware, BEC, DDoS, and Data Theft (Task 1) in the ISACA CCOA audio course.
Differentiate Ransomware Attacks and Understand the Business-Stopper Impact
Listen to Differentiate Ransomware Attacks and Understand the Business-Stopper Impact in the GIAC GCIL audio course.
Handle Ransomware Communications: Stakeholders, Attackers, and Legal Coordination
Listen to Handle Ransomware Communications: Stakeholders, Attackers, and Legal Coordination in the GIAC GCIL audio course.
Incident Response Programs: Ransomware and Vendor Incidents
Privacy law intersects with cybersecurity when incidents occur. This episode explains how organizations build incident response programs to address threats like ransomware, data breaches, and vendor security failures.…
Malware Indicators: Ransomware, Trojans, Worms, Spyware, and Fileless Malware (2.5)
Listen to Malware Indicators: Ransomware, Trojans, Worms, Spyware, and Fileless Malware (2.5) in the CompTIA Security+ audio course.
Manage Ransomware Incidents: Containment, Recovery Choices, and Risk Tradeoffs
Listen to Manage Ransomware Incidents: Containment, Recovery Choices, and Risk Tradeoffs in the GIAC GCIL audio course.
Recognize Malware Families From Ransomware to Fileless Attacks With Confidence
Listen to Recognize Malware Families From Ransomware to Fileless Attacks With Confidence in the CompTIA A+ audio course.
Spaced Retrieval Review: Cloud, Supply Chain, and Ransomware Attack Playbooks
Listen to Spaced Retrieval Review: Cloud, Supply Chain, and Ransomware Attack Playbooks in the GIAC GCIL audio course.
Trace Ransomware Methodology: Initial Access, Privilege Gain, Encryption, Extortion
Listen to Trace Ransomware Methodology: Initial Access, Privilege Gain, Encryption, Extortion in the GIAC GCIL audio course.
Understand Malware and Ransomware Impact: What Breaks First in Data Systems
Listen to Understand Malware and Ransomware Impact: What Breaks First in Data Systems in the CompTIA DataSys+ audio course.
Data Encrypted for Impact (T1486)
An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
Attacker Communications Governance
Attacker communications governance defines who may communicate with an adversary, under what authority, through which channels, and with what legal, safety, and evidence controls.
Backup Isolation and Immutability
Backup isolation and immutability reduce the chance that compromised production identities, systems, or administrators can alter or destroy recovery data.
CP-3(1) — Simulated Events
The use of simulated events creates an environment for personnel to experience actual threat events, including cyber-attacks that disable websites, ransomware attacks that encrypt organizational data on servers, hurricanes that damage or destroy organizational facilities, or hardware or software failures.
Crime-as-a-Service Nation: Inside the Cybercrime Franchise Economy
Picture a “vendor ecosystem” where you can buy initial access to a Fortune 500, rent turnkey ransomware operations, outsource money laundering, and get 24/7 customer support if your campaign stalls. In today’s environments, that is not a thought experiment, it is the lived reality of Cybercrime-as-a-Service (CaaS).
Agrius (G1030)
A defensive guide to the Enterprise ATT&CK activity-cluster record G1030, including naming overlap, evidence, behavior relationships, and attribution confidence. The official record summarizes public reporting describing an Iranian activity cluster reported in ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.
Akira (S1129)
A defensive guide to the Enterprise ATT&CK software record S1129, including identification, dual-use context, behavior analytics, and investigation. The official record summarizes public reporting describing ransomware associated with Akira operations and reported in Windows and ESXi variants.