Скачать или смотреть Detecting Modern Ransomware Attacks in the Financial Sector

From Identity Admins to Cloud Compromise: Detecting Modern Ransomware Attacks in the Financial Sector

🎙️ Arda Büyükkaya, Senior Cyber Threat Intelligence Analyst, EclecticIQ
📍 Presented at SANS DFIR Summit 2025

Human-operated ransomware groups have increased their focus on cloud environments, targeting identity administrators and cloud misconfigurations to gain persistent access.
The financial sector is especially focused by Ransomware groups, given its high value target and reliance on cloud-based identity platforms, virtual infrastructure, and SaaS applications, which provide multiple avenues for compromise. By compromising identity admins and abusing misconfigured access controls, adversaries can stealthily pivot through cloud workloads and initiate domain-wide ransomware attacks.

View upcoming Summits: https://www.sans.org/u/DuS