Lucky leaks: 400+ mln files are worth a thousand words
2024-10-25 , Europe - Main Room

Do you hate ransomware? Good, so do we.

Are you curious about gangs TTPs, leak value and effective strategies to limit the impact of a breach?

We will do our best to share our ongoing research and to provide you with all of this. And possibly some more.


Me and my good friend Eireann spent the last two years collecting and studying the activity of 50+ ransomware groups through their DLS (Data Leak Site), more often than not hidden by the Tor network.

We discovered that the list of the files inside the leaks can provide plenty of information about the gang's TTP, the impact for the victim and the most effective countermeasures.

We also started in August 2024 to automatically analyse leaks at scale, to better understand the real impact for the compromised entity.

We want to present the current results of this ongoing research effort, together with some methodologies we used and some mistakes criminals did that we were able to exploit.

The talk will not be recorded and is tagged TLP:RED.

I am a passionate cybersecurity researcher who has spent the last 18 years learning and sharing as much as possible about this fascinating field.

During these years, I have been fortunate enough to work on multiple aspects of the cybersecurity world, including digital forensics, incident response, cryptography, penetration testing, reverse engineering, research and development, and threat intelligence.

This speaker also appears in: