2026-10-30 –, Main Hall
Ransomware is no longer the work of isolated hackers, but an organised criminal ecosystem operating on a service-based model. This talk explores the realities of ransomware-as-a-service (RaaS), where developers, affiliates and negotiators work together to deliver attacks. Using real data from ransomware leak sites, including ransom notes and negotiation chats, I'll examines how these groups operate and the psychology behind their attacks. The talk cuts through common misconceptions and shows why organisations should be more prepared than ever.
During my placement at the West Midlands Regional Cyber Crime Unit within West Midlands Police, I gained first-hand insight into the realities of ransomware incidents and became particularly interested in how modern ransomware groups operate less like isolated hackers and more as sophisticated criminal enterprises. This talk draws on research I have conducted into ransomware-as-a-service (RaaS) groups, including analysis of victim leak sites, ransom notes, and real negotiation chats associated with groups such as Scattered Spider and Akira.
The presentation will explore what negotiation chats reveal about extortion tactics and the use of human psychology to apply pressure during incidents. Using a real negotiation case study, I will highlight indicators of manipulation and operational structure within these groups. The talk will also challenge common misconceptions about ransomware and show how understanding attacker behaviour can strengthen organisational preparation. It will conclude with lessons for organisations on response planning and reducing the impact of ransomware attacks.
Becky is a Cyber Crime Intern at the West Midlands Regional Cyber Crime Unit in the UK and a Computer Science student at the University of Birmingham. Her work spans supporting cyber crime investigations, delivering cyber security training, and researching emerging cyber threats. Alongside this, she is involved in educational outreach and conference speaking to improve cyber awareness. She is also active in widening participation in the industry through leadership roles with CyberWomen@Birmingham and Leading Cyber Ladies Midlands.