The Backup Wrap-Up

Ransomware sanctions are something most companies never think about — until they're staring down a ransom demand from a group the US government has already put on a sanctions list. In this episode, Dr. Mike Saylor walks us through a real incident involving a construction company, hundreds of millions in active contracts, and the Lazarus Group — a North Korean state-sponsored threat actor. Before that company could pay a single dollar in ransom, they had to figure out whether doing so would trigger federal penalties that dwarfed the ransom itself. We're talking fines of 10x to 100x the payment amount, and in some jurisdictions, jail time.

This is one of those episodes where the story alone is worth your time. Mike was in the room for this incident, negotiating directly with the Lazarus Group over a weekend — and yes, it turns out North Korean cybercriminals have a surprisingly functional help desk. But beyond the story, there's real actionable information here about OFAC (the Office of Foreign Asset Control), how the US Treasury tracks Bitcoin wallets to identify sanctioned actors, and what you actually need to do the moment ransomware hits your organization.

We also get into why paying a ransom paints a target on your back — 70% of companies that pay get hit again within six months — and why immutable backups are the only thing that truly keeps you out of this situation.

Chapters:

0:00 Intro

1:31 Meet the Guests: Curtis, Prasanna, and Dr. Mike Saylor

4:10 Case Study: A Construction Company and the Lazarus Group

6:34 Are These Bad Guys Sanctioned? Introducing OFAC

8:05 Why Ransomware Funds Terrorism, Drug Trafficking, and Worse

11:00 Sanctions Penalties: Fines That Can Put You Out of Business

12:24 Colonial Pipeline and Exceptions for Critical Infrastructure

13:26 How the Government Tracks Bitcoin Wallets

16:27 Global Sanctions: UK and Australia Have Their Own Rules

18:31 Pay Once, Pay Again: The 70% Re-Attack Rate

20:43 Proof of Life: Don't Pay Without It

23:38 What To Do When You Get Hit: The Right Order of Operations

25:17 Immutable Backups: The Only Real Answer

27:07 How the Construction Company's Backups Got Wiped

33:07 Build Your Team Before the Bad Day: FBI InfraGard and More

The cost of a ransomware attack goes way beyond the ransom itself — and most organizations don't find that out until it's too late. In this episode of The Backup Wrap-up, W. Curtis Preston (Mr. Backup) and co-host Prasanna Malaiyandi sit down with Dr. Mike Saylor of Black Swan Cybersecurity to walk through every category of cost that hits when ransomware strikes.

The case that kicks everything off: UVM Health Network, October 2020. Over 1,300 servers encrypted, staff forced back to paper records, patient care disrupted for weeks. Total tab? Over $63 million — and they never paid the ransom.

From there, we go category by category: people costs (overtime, third-party IR firms, emergency hardware), lost business revenue, regulatory fines, reputational damage that doesn't wash off, staff burnout and resignations, supply chain chaos, payment processor shutdowns, and cyber insurance fine print that can leave you holding the bag even when you think you're covered.

We also cover what you should be doing right now — before any of this happens to you. Starting with a Business Impact Analysis, which Mike argues most small-to-medium businesses can knock out in one to three weeks. Knowing what a downed system costs you per hour is exactly the information that gets you budget from leadership and a plan that actually works when the feces hits the rotary oscillator.

Chapters:

00:01:44 - Intro & Welcome

00:03:45 - Case Study: UVM Health Network ($63M, 1,300 Servers Down)

00:07:12 - People Costs: Overtime, Staffing & Third-Party IR Firms

00:10:01 - The Odds Are Damn Near 100% — Set Up Your IR Relationship Now

00:13:00 - Hardware Costs & Emergency Spending

00:14:05 - Lost Business Revenue (Current and Future)

00:15:14 - The Stat That Should Scare You: Over 50% Don't Survive

00:16:38 - Regulatory Fines (GDPR, California & More)

00:19:32 - Reputational Damage: Your Customers Never Forget

00:21:28 - Staff Burnout, Exhaustion & Resignations

00:22:40 - Supply Chain Disruption & Credit Rating Impact

00:24:07 - Payment Processor Shutdown (Real Case: Dental Practice)

00:26:00 - Cyber Insurance: Fine Print, Claim Denials & Premium Spikes

00:27:52 - Post-Attack Process Remediation Costs

00:29:36 - Business Impact Analysis: Why You Need One Before It Happens

00:35:00 - Action Items

00:39:41 - Recovery Prioritization & Recovery Point Objectives

00:44:43 - Wrap

Polymorphic malware is the kind of threat that changes its own code — its signature, its behavior, even the command-and-control server it reports to — specifically so your antivirus can't catch it. In this episode, Dr. Mike Saylor of Black Swan Cybersecurity joins Prasanna and me to break down exactly how this works, why signature-based detection keeps losing the race, and what defenders actually need to do differently.

Mike walks us through ViraLock, one of the most well-known early examples of polymorphic malware, and explains the gap between infection and detection that attackers exploit. We also get into the difference between polymorphic and metamorphic malware — and metamorphic is a lot scarier. Then we cover waterhole attacks, a red team story that will make you rethink how fast attackers can own a network, and what behavioral detection looks like when it's actually working.

If you thought keeping your antivirus updated was enough, this episode is going to change your mind.

Chapters:

00:00:00 – Intro

01:35 – Meet the guests: Prasanna Malaiyandi and Dr. Mike Saylor

02:58 – What is polymorphic malware? The ViraLock story

05:52 – How polymorphic code changes its own signature

10:04 – Disguised executables and the human factor

12:23 – Polymorphic vs. static malware: what's the real difference?

14:15 – Metamorphic malware: nation-state-level scary

16:01 – The Frankenstein virus: a conceptual metamorphic example

16:52 – Waterhole attacks: infecting the shared file everyone downloads

18:32 – How polymorphic malware stays alive: the red team story

21:28 – Behavioral detection and baselining: how you actually fight back

26:57 – Risk-based defense: protect what matters most

A PyPI software supply chain attack hit LiteLLM — a library pulled into developer environments 97 million times a month — and if you use it, you may already be compromised. This wasn't a fake package or a typo-squatting trick. Attackers stole real credentials, published malicious code as the real thing, and walked out with SSH keys, cloud credentials, Kubernetes tokens, API keys, and more — all encrypted and sent home before anyone knew what happened.

I'm doing something I've never done before: an emergency episode, recorded and published immediately because this is that serious. I brought in Dr. Mike Saylor, co-author of our book Learning Ransomware Response and Recovery, and my co-host Prasanna Malaiyandi to break down exactly what happened, how to find out if you were hit, and what you need to do to protect yourself going forward.

We open with a story from 1982 that perfectly captures what this attack really is — getting poisoned by something you trusted completely. That framing matters. This wasn't a failure of the library. It was a failure of the supply chain. And it can happen again.

Chapters:

00:00:00 - Intro: Why this is an emergency episode

00:01:35 - Meet the guests: Dr. Mike Saylor and Prasanna Malaiyandi

00:02:31 - The Tylenol poisoning analogy and what it means for software supply chains

00:05:51 - What LiteLLM is and what the malware actually did to your environment

00:09:04 - Dependencies explained: why you're affected even if you didn't install LiteLLM directly

00:12:24 - How to find out if you were hit: the first things to check right now

00:14:23 - IOCs and TTPs: what to look for in your logs and on your systems

00:19:07 - Network indicators: unusual traffic and what it tells you

00:22:12 - How security teams can find out if developers installed it without telling anyone

00:30:38 - Action items for the future: inventory, pinning, and hash verification

00:36:55 - Sandboxing new downloads before they touch your environment

00:37:59 - Immutable backups: why this attack makes the case for them

00:40:33 - Modern authentication: MFA, its limits, and why passkeys matter

00:46:53 - Where to get threat intel so you hear about attacks like this faster

00:53:23 - Wrap-up

If you installed or upgraded LiteLLM on or after March 24, 2026 without a pinned version, stop what you're doing and listen to this episode first.

The story:

https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/

https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/

https://snyk.io/articles/poisoned-security-scanner-backdooring-litellm/

https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign

https://checkmarx.com/zero-post/python-pypi-supply-chain-attack-colorama/

https://www.upwind.io/feed/litellm-pypi-supply-chain-attack-malicious-release

https://docs.litellm.ai/blog/security-update-march-2026

https://www.helpnetsecurity.com/2026/03/25/teampcp-supply-chain-attacks/

https://www.darktrace.com/resources/the-cisos-guide-to-cyber-ai

https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/

Resources:

https://www.stopransomware.com

https://www.cisa.gov

https://www.cve.org/

Fileless malware is one of the most dangerous attack types out there — it never writes to your hard drive, lives entirely in RAM, and can steal your credentials before your antivirus has any idea it's there. In this episode, I bring in Dr. Mike Saylor — my co-author on Learning Ransomware Response & Recovery — to break down exactly how this attack works, why it's so hard to detect, and what you can actually do to protect yourself.

Mike walks us through how fileless malware hides in memory, how bad guys maintain their foothold even after a reboot by modifying registry keys or rewriting the operating system itself, and why the ArcGIS attack is a perfect real-world example — attackers sitting undetected inside a network for two years. We also get into MFA, specifically why a lot of MFA setups are done wrong, why passkeys are the better answer, and when it's time to bring in an EDR or XDR tool.

Fair warning: the action items here are a bit more advanced than our usual stuff. Think of this as the 401k conversation — don't have it before you've built your emergency fund. But this is stuff you absolutely need to know.

00:01:26 - Welcome & intro

00:04:43 - What is fileless malware?

00:09:16 - How fileless malware achieves persistence (ArcGIS case study)

00:15:02 - Can fileless malware spread beyond one machine?

00:16:43 - Defending yourself: MFA done right

00:20:38 - Why passkeys beat MFA

00:23:00 - EDR and XDR explained

00:28:03 - How modern EDR tools detect fileless malware

00:30:01 - Wrap-up and action items

A living off the land attack is one of the sneakiest techniques in a ransomware operator's playbook — and in this episode, Dr. Mike Saylor breaks down exactly what it is, how it works, and what your organization can actually do about it.

Instead of bringing their own tools into your environment (which might trip your alarms), attackers just use what's already there. PowerShell. WMI. RDP. The same tools your admins run every single day. To your monitoring systems, it looks completely normal. That's the whole point.

Mike and Curtis cover why attackers prefer your tools over their own, how recon can quietly run for 30 to 90 days before the attack goes loud, and what defenders can actually do about it — removing admin privileges, system hardening, golden images, application whitelisting, and free tools like Nmap and Wireshark. There's also a match.com story involving organized crime and a wooden casket on someone's front porch that you really don't want to miss.

0:00 - Intro

1:21 - Welcome and Book Announcement

3:28 - What Is a Living Off the Land Attack?

5:38 - Real-World Example: Conti Ransomware and WMI

8:12 - Why Attackers Use Your Tools Instead of Their Own

13:05 - Admin Privileges: Best Practice vs. Reality

17:31 - The Louvre Heist Analogy

20:08 - Recon Phase: Low and Slow

24:16 - What Defenders Can Do

25:55 - RDP and Remote Access

29:48 - The Recon Timeline: 30-90 Days

30:48 - PowerShell and System Hardening

34:10 - Network Discovery Tools (Nmap and Wireshark)

37:37 - Application Whitelisting and Geo IP Blocking

42:08 - Action Items and Wrap-Up

Password manager vulnerabilities aren't just about bad code — and a new research paper out of Zurich just proved it. Researchers analyzed three of the most popular password managers and found fundamental design flaws baked into the very architecture that's supposed to keep your credentials safe. Curtis and Prasanna break it all down and tell you what to do about it.

If you've ever been that person who asks "but what if the password manager gets hacked?" — this episode is for you. And if you haven't been asking that question, you probably should start. A research team looked at LastPass, Bitwarden, and Dashlane — products with a combined 60 million users representing roughly 23% of the password manager market — and what they found wasn't sloppy programming. It was something harder to fix: architectural problems at the core of how encrypted vaults work.

Curtis walks through how the zero-knowledge encryption model works, why the vault recovery process creates an inherent trust problem, and why the researchers were able to exploit that trust by impersonating the server during vault recovery. Prasanna adds another layer — the field-level encryption issues inside the vaults themselves, where there's no strong verification that data hasn't been manipulated. It's not theoretical. It's a real attack surface.

The good news? Curtis still believes password managers are the right tool for today — better than sticky notes on a monitor (yes, he saw that in real life) and better than reusing passwords. But he's also clear that passkeys are the right direction for the future, even if the current implementation is still a little rough around the edges.

https://eprint.iacr.org/2026/058.pdf

https://www.theregister.com/2026/02/16/password_managers/

https://www.forbes.com/sites/daveywinder/2026/01/23/lastpass-issues-critical-warning-for-users---password-attacks-underway/

What is an initial access broker — and why does it matter to your organization? In this episode, W. Curtis Preston and Prasanna Malaiyandi are joined by Dr. Mike Saylor of Black Swan Cybersecurity to break down the role of the initial access broker in today's ransomware attacks.

Most people picture ransomware as a single bad guy with a keyboard. The reality is way scarier. There's an entire criminal supply chain out there, and the initial access broker is the specialist at the front of it. These are the people who do nothing but break in — stealing credentials, exploiting vulnerabilities, hijacking sessions — and then sell that access to other criminals who do the dirty work. Dr. Mike Saylor walks us through a real case study from 2024 where an employee's personal Gmail account — with a Google Docs folder literally named "passwords" — became the entry point for a corporate ransomware attack months later. This stuff is real, it's happening constantly, and most organizations have no idea how exposed they are.

We cover what IABs target, how they package and sell access, what "coincidental passwords" are and why they're so dangerous, and what practical steps you can take today to make your organization a harder target.

Chapters:

00:00 - Intro: What Is an Initial Access Broker?

02:12 - Welcome, Introductions, and a Little Judging

03:33 - Defining the Initial Access Broker

04:31 - Real Case Study: How Bob's Gmail Became a Corporate Breach

07:16 - How IABs Package and Sell Access

10:32 - How Stolen Credentials Get Bundled and Priced

29:48 - RDP, VPN Vulnerabilities, and What IABs Are Hunting

32:54 - Web Shells Explained

35:08 - Session Hijacking and Man-in-the-Middle Attacks

36:16 - Would Eliminating IABs Stop Ransomware?

36:49 - How the Cybercriminal Ecosystem Evolved to Create IABs

39:51 - Practical Takeaways: What You Can Do Right Now

40:45 - The Numbers: 37 Billion Records and the ShinyHunters Breach

Ransomware as a service has turned cybercrime into a franchise business — and in this episode, Dr. Mike Saylor and I break down exactly how it works, who's buying, and why the buyer might end up as the patsy.

If you thought ransomware was just a lone hacker writing code in a basement, this episode is going to change how you think about it. Ransomware as a service means that today, literally anyone — no technical skills required — can pay someone to launch a ransomware attack on their behalf. You hand over the money, tell them what you want, and sit back and watch your crypto wallet. That's it. No portal. No dashboard. No login. Just a chat on the dark web through the TOR network and a prayer that they actually do what you paid for.

Dr. Mike Saylor walks us through the full criminal ecosystem — from the initial access brokers who collect and sell validated email addresses, to the botnet operators who rent out millions of compromised computers by the hour, to the affiliate programs that tie it all together. We cover the franchise model, the "no honor among thieves" reality of these transactions, and why the person who buys into ransomware as a service might just end up as law enforcement's fall guy.

This is one of those episodes where the more you learn, the more you realize how much the threat picture has changed — and why your backups are more important than ever.

Chapters:

00:00:00 - Episode Intro

00:01:17 - Introductions & Welcome

00:03:25 - Setting the Stage: CryptoLocker and the Birth of a Criminal Industry

00:07:17 - Defining Ransomware as a Service: The Franchise Model

00:10:36 - The Amazon/AWS Analogy and How Botnets Power the Attacks

00:17:10 - No Portal, No Dashboard: How Dark Web Transactions Actually Work

00:19:17 - Why Do RaaS Operators Offer the Service? The Lottery Ticket Theory

00:21:59 - The Affiliate Model: How the Criminal Ecosystem Specializes

00:26:33 - How Many RaaS Groups Exist — and Who's Buying?

00:29:36 - RaaS as Subterfuge: The Conti Group and the Costa Rica Attack

00:30:49 - Who Are These Criminals, Really?

The cryptolocker virus was the attack that turned ransomware from a nuisance into a full-blown criminal industry — and in this episode of The Backup Wrap-up, we break down exactly how that happened. W. Curtis Preston (Mr. Backup) sits down with co-host Prasanna Malaiyandi and cybersecurity expert Dr. Mike Saylor to trace the full evolution of ransomware and explain why CryptoLocker was the turning point.

If you've ever wondered how ransomware went from fake pop-up messages to billion-dollar criminal enterprises, this is the episode for you. We start with the earliest days — scareware attacks that did nothing more than frighten you into paying — and walk through the progression of encryption methods that made ransomware increasingly dangerous. Dr. Mike Saylor breaks down the difference between symmetric and asymmetric encryption in plain language, and explains why the move to public-private key pairs made it so much harder for victims to recover without paying up.

Then we get into the cryptolocker virus itself: how it spread through fake FedEx emails, why it kick-started phishing awareness training, what Operation Tovar did to shut it down, and — just as interesting — what the bad guys learned from its failures. We cover the role of the Zeus botnet, how Bitcoin became the payment method of choice, and why ransoms started out at just a few hundred bucks. We also talk about what happened next: the rise of data exfiltration, double extortion, and even triple extortion where attackers go after the victims of the victims.

Plus, we take a side trip into the LastPass breach and pour one out for the guy who lost his crypto fortune in a landfill.

Whether you're in IT, security, or just want to understand how ransomware works, this episode gives you the full picture.

Chapters:

00:00:00 — Intro

00:01:22 — Welcome and Introductions

00:04:11 — The Three Generations of Ransomware

00:05:01 — Scareware: Fake Attacks That Did Nothing

00:05:42 — Ciphers and Decoder Ring Encryption

00:06:38 — Symmetric Encryption Explained

00:09:25 — Asymmetric (Public-Private Key) Encryption

00:12:46 — Why Asymmetric Encryption Made Ransomware Stronger

00:15:44 — What Was the CryptoLocker Virus?

00:16:25 — Lessons CryptoLocker Taught Victims and Criminals

00:18:03 — Operation Tovar Takes Down CryptoLocker

00:19:54 — Bitcoin, Ransom Amounts, and Getting Paid

00:23:20 — Botnets Explained: Networks of Zombie Computers

00:26:22 — Recap: Three Phases of Ransomware

00:27:09 — Double Extortion and Data Exfiltration

00:28:01 — The LastPass Connection

00:28:47 — The Lost Crypto Hard Drive