When an organization falls victim of a ransomware attack and calls on our company to assist with the restoration I have the privilege of being on the calls with the forensic team. I’ve learned quite a bit about how the hackers do what they do. One of the details that surprised me personally was when the forensics team told the client that once the “bad actors” gained access to their network they began looking through files searching specifically for not only financial information, but also for evidence of a Cyber Insurance policy.
The client who had fallen victim had a policy in place, but did not keep a copy of it electronically. Instead they filed the paper copy in a filing cabinet. Because of this the ransom was set very low in this case.
I would like to hear from others what interesting details they have learned by sitting in on a forensic investigation, or from falling victim of ransomware.
Teri
