TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

ESET WeLiveSecurity

What the ransom note won’t say

2026-04-20 · Read original ↗

ATT&CK techniques detected

15 predictions
T1486Data Encrypted for Impact
97%
“what the ransom note won ’ t say in march 2024, an affiliate of the blackcat ransomware gang took to a cybercrime forum with a complaint. they ’ d carried out the attack on change healthcare – one of the largest healthcare data breaches in u. s. history – but never got their cut …”
T1486Data Encrypted for Impact
96%
“, they pave the way for the intrusion long before the ransom note arrives. so if your organization views a ransomware incident only as a near - random break - in that happened almost out of nowhere, its defenses will fail to account for how well - resourced and iterative the thre…”
T1486Data Encrypted for Impact
96%
“by, of course, and targeted disruptions create real uncertainty and impose real costs. but shutting down a firm in a competitive market doesn ’ t shut down the market. as the incentives stay aligned, the demise of a ransomware group triggers competition among survivors to take it…”
T1588.002Tool
95%
“ai is making the market, not to mention the wider cybercrime economy, even easier to join. eset researchers suspect that ai assisted in the development of some edr killers – the wares of the warlock gang are but one example. in fact, last year eset experts also spotted the first …”
T1486Data Encrypted for Impact
91%
“t be starved of participants. ransomware operations are built to scale regardless of whether or not any individual ' stakeholder ' possesses formidable skills. the red queen ’ s race over the years, the ransomware playbook of yore – lock the files and demand a ransom – has given …”
T1657Financial Theft
90%
“, they pave the way for the intrusion long before the ransom note arrives. so if your organization views a ransomware incident only as a near - random break - in that happened almost out of nowhere, its defenses will fail to account for how well - resourced and iterative the thre…”
T1657Financial Theft
88%
“what the ransom note won ’ t say in march 2024, an affiliate of the blackcat ransomware gang took to a cybercrime forum with a complaint. they ’ d carried out the attack on change healthcare – one of the largest healthcare data breaches in u. s. history – but never got their cut …”
T1068Exploitation for Privilege Escalation
84%
“same underlying technique : loading a legitimate but vulnerable driver onto the target machine and using it to gain the kernel - level privileges needed to shut the security product down. the technique is called bring your own vulnerable driver ( byovd ), and the vulnerable drive…”
T1486Data Encrypted for Impact
73%
“crude demand, and waits for their rewards. clear and simple, but almost certainly incomplete. understandably, the blast and especially its impact draw the headlines, while everything that fed it stays ‘ off camera. ’ but that ' s only where the operation finally surfaces. much of…”
T1490Inhibit System Recovery
62%
“what the ransom note won ’ t say in march 2024, an affiliate of the blackcat ransomware gang took to a cybercrime forum with a complaint. they ’ d carried out the attack on change healthcare – one of the largest healthcare data breaches in u. s. history – but never got their cut …”
T1652Device Driver Discovery
52%
“same underlying technique : loading a legitimate but vulnerable driver onto the target machine and using it to gain the kernel - level privileges needed to shut the security product down. the technique is called bring your own vulnerable driver ( byovd ), and the vulnerable drive…”
T1486Data Encrypted for Impact
48%
“our security stack ward off a byovd attack that uses the drivers now in circulation? what happens to our environment if an msp in our supply chain is compromised? which ransomware actors are actively targeting our sector, and which edr killers are they buying? if you can ’ t answ…”
T1080Taint Shared Content
40%
“t be starved of participants. ransomware operations are built to scale regardless of whether or not any individual ' stakeholder ' possesses formidable skills. the red queen ’ s race over the years, the ransomware playbook of yore – lock the files and demand a ransom – has given …”
T1486Data Encrypted for Impact
40%
“prey gets faster. prey develops camouflage, so predators develop sharper vision. biology calls this the red queen effect, named after a character in lewis carroll ’ s through the looking - glass who must keep running just to stay in place. security practitioners will recognize th…”
T1588.001Malware
33%
“t be starved of participants. ransomware operations are built to scale regardless of whether or not any individual ' stakeholder ' possesses formidable skills. the red queen ’ s race over the years, the ransomware playbook of yore – lock the files and demand a ransom – has given …”

Summary

An attack is what you see, but a business operation is what you’re up against