SKBSec @skbsec

Ransomware was involved in 48% of the breaches Verizon analyzed in 2026. But the ransom note isn't the start of the attack. It's step six. How attackers get in, why backups aren't enough anymore, and what to do in the first hour 👇 skbsec.com/what-is-ransom…

The numbers: ~45% of all data breaches now happen in cloud environments. ~80% of orgs had a cloud security incident in the past year.

Above the line (yours): your data, access permissions, configs, identity management, which storage buckets are public vs. private. The provider locks the building. You lock your own apartment door.

Below the line (provider's job): physical servers, data centers, core network, the layer that walls off your data from other customers'. They're extraordinarily good at this part.

SKBSec @skbsec

6 days ago

A researcher finds a company's entire customer database sitting in a cloud storage bucket. Unprotected. Reachable by anyone with the link. No hacking. No exploit 🧵

1 0 0 6 0

The misunderstanding: "the cloud" isn't a place. It's a rented arrangement with a dividing line through it. That line has a name: the shared responsibility model.

A setting, left on its default, had simply never been changed by anyone. That's the plot behind a huge share of the biggest cloud breaches of the last 2 years.

A researcher finds a company's entire customer database sitting in a cloud storage bucket. Unprotected. Reachable by anyone with the link. No hacking. No exploit 🧵

A market doesn't get arrested. Wrong question: "could a skilled hacker breach us?" Right question: "which specialized role in this supply chain could reach us?"

Jan 2026: US law enforcement seized RAMP, a major forum connecting IABs, affiliates, and RaaS operators. Activity dipped for weeks. It's already resurfacing under new names.

Q1 2026 ransomware revenue: $529.2M. Up 39%. That scale doesn't come from lone operators. It comes from a market.

Around the core: packer services to dodge antivirus, bulletproof hosting, money-laundering specialists. And real customer support — scripts, live chat, decryption-testing tools.

One group, "The Gentlemen," offers affiliates a 90% cut — specifically to poach talent from rival platforms. Affiliate recruitment, run like a sales incentive.

Affiliate. Buys that access. Rents ready-made ransomware from a RaaS platform. Deploys it. Negotiates. Keeps 70–90% of whatever gets paid.

SKBSec @skbsec

2 weeks ago

Modern ransomware isn't one hacker. It's a supply chain of specialists who often never speak to each other. Here's who actually gets paid:

1 0 0 3 0

Initial Access Broker. Breaks into networks. Doesn't touch them further. Sells the access for $500–$5,000 on criminal forums. Made $14M+ in 2025 doing only this.

Modern ransomware isn't one hacker. It's a supply chain of specialists who often never speak to each other. Here's who actually gets paid:

SKBSec @skbsec

2 weeks ago

Same tone as a telecom retention line. That chat wasn't staffed by the person who broke in. It almost never is anymore.

1 0 0 4 0

Follow newsletter out. Join weekly Free: skbdecoded.beehiiv.com/subscribe

Same tone as a telecom retention line. That chat wasn't staffed by the person who broke in. It almost never is anymore.

A hospital's files get encrypted. The ransom note has a link to live chat. They open it expecting silence. Instead: a support rep, replying in minutes, walking them through payment🧵

An Uber contractor gets a login approval request. He declines it. Another. Decline. Another — every few minutes, for over an hour. Exhausted, he finally taps approve just to make it stop. Attacker is in. Slack, VPN, source code 🧵

An Uber contractor gets a login approval request. He declines it. Another. Decline. Another — every few minutes, for over an hour. Exhausted, he finally taps approve just to make it stop. Attacker is in. Slack, VPN, source code 🧵