Dissecting the Ransomware Kill Chain w/ Oscar Minks

## Ransomware's Human Cost

Oscar Minks, CTO at FRSecure, frames ransomware through victim impact: average recovery downtime exceeds 21 days, a duration most small businesses cannot survive. Global costs reached roughly $20 billion in 2021, up from $5 billion in 2017, with every sector targeted regardless of perceived value.

## Mapping the Kill Chain

Minks walks through attacker reconnaissance mirroring red-team methodology: enumerating domains and subdomains for look-alike phishing sites, scanning external IP space and ASNs, identifying open services, and harvesting leaked credentials from breach dumps and projects like Project Hifi.

## Pre-Attack Intelligence Gathering

Before payload delivery, adversaries study organizational structure, technology stack, and credential exposure. Leaked corporate credentials remain a primary entry vector, often available at scale through underground markets and public breach collections.

## Defensive Takeaways

Understanding each kill-chain stage enables proportional controls: domain monitoring for typosquats, external attack-surface management, credential rotation after third-party leaks, and recovery planning that assumes multi-week outages. Minks emphasizes that good people and small co-ops deserve the same rigor as large enterprises.