One mistake away: The ransomware threat facing Australian organisations

Two incident responders, who between them have worked hundreds of ransomware cases across Australia and New Zealand, are sharing what they've seen firsthand. They'll walk you through a real ransomware attack from start to finish, drawing on evidence recovered from actual engagements. No vendor reports. No theory. Just what happens in practice.

The hard truth is, by the time systems lock up, attackers have typically been inside for weeks, and the data is already gone. Most people think ransomware is a single event. It isn't. It's a campaign. This session maps the full attack lifecycle across five phases, exactly as it plays out inside Australian organisations right now. 

It starts at the front door. Stolen credentials. Exposed remote desktop. A public-facing application that didn't get patched. Or an access broker who sold network entry for a few hundred dollars on a dark web forum. From there, attackers move quietly, escalating privileges, identifying the most valuable data, and staging it for theft, all before anyone triggers encryption. That's where double extortion changes everything. By the time the ransom note appears, the data has already left the network. Paying the ransom won't change that. Then there's the part that rarely gets discussed publicly: the negotiation. Most victims walk into it completely unprepared. Threat actors do this for a living. They manufacture urgency, apply pressure, and manage their own reputation inside the criminal ecosystem with a level of process that would surprise most people. Your team is doing it for the first time. That gap is obvious to the other side. 

The session closes on how dark web leak sites work as a business tool for threat actors, what gets posted, and what public exposure actually means for the organisations caught up in it. 

Because threat actors don't care how mature your programme is if someone sets their password to Pa55word.