1. To Pay or Not to Pay? Intelligent Ransomware Response

2. INTELLIGENCE AS A SERVICE
About Me
AARON SHERMAN
Senior Director of Cyber Threat Intelligence
Braintrace - Intelligence Cybersecurity
Aaron currently serves as Senior Director of Cyber Threat Intelligence at Braintrace. Bringing nearly 15 years of cyber threat detection and neutralization success for the U.S. government, Aaron most recently held the position as Cyber Special Agent with the Federal Bureau of Investigation (FBI) in the Washington, DC and Salt Lake City Field Offices. While at the FBI, Sherman responded to and investigated cyber intrusions and data breaches perpetrated by Advanced Persistent Threat (APT) actors and cyber criminal groups around the world.
As a leading authority on emerging threats, he has implemented new methodologies for targeting and monitoring cybercriminals on the dark and deep web. His efforts have resulted in the detection and disruption of numerous cybercriminal campaigns targeting US organizations.
You can connect with Aaron at linkedin.com/in/aaron-sherman
INTELLIGENCE AS A SERVICE 2

3. What could possibly go wrong?!
Incident Response
What could possibly go wrong?!

5. INTELLIGENCE AS A SERVICE
Incident Response Steps
Detection
Analysis
Containment
Eradication
Recovery
Post-Incident Activity
INTELLIGENCE AS A SERVICE 5

6. INTELLIGENCE AS A SERVICE
Incident Response Steps
Analysis
ID specific variant
Determine attack vector
Prepare for the OCM
INTELLIGENCE AS A SERVICE 6

7. INTELLIGENCE AS A SERVICE
Prepare for the OCM
Wait, what’s bitcoin?
How long will it take?
Backups?
How much is the extortion?
Can we negotiate?
INTELLIGENCE AS A SERVICE 7

8. INTELLIGENCE AS A SERVICE
The OCM
WHAT IS BITCOIN?!?
How much is the extortion?
Can we negotiate?
INTELLIGENCE AS A SERVICE 8

9. INTELLIGENCE AS A SERVICE
Quick Fact Finding
ID Specific Variant
Attacker Intelligence
Attacker Counterintelligence
Payment Intelligence
OSINT
INTELLIGENCE AS A SERVICE 9

10. INTELLIGENCE AS A SERVICE
Quick Fact Finding
GandCrab (no decryption yet)
Attacker Identified
No victim intel
Payments: Asking $8,000 USD
Lowest: $1,646 USD
Average: $4,680 USD
Full recovery ~72 hours after payment
INTELLIGENCE AS A SERVICE 10

11. INTELLIGENCE AS A SERVICE
Negotiations
INTELLIGENCE AS A SERVICE 11

12. INTELLIGENCE AS A SERVICE
Negotiation Tips
Treat like business deal
Get proof of life
Don’t stall
Team approach
No false flag operations*
OPSEC!
INTELLIGENCE AS A SERVICE 12

13. Meanwhile, back in Russia…

14. QUESTIONS & ANSWERS Aaron Sherman
Senior Director of Cyber Threat Intelligence
linkedin.com/in/aaron-sherman
INTELLIGENCE AS A SERVICE 14