Powering Proactive Defense: How MSSPs Can Strengthen Threat Hunting Against Ransomware

What happened

The research also found that the malware (software written to damage a system or steal from it)’s encryption (scrambling data so only the holder of the key can read it) design may leave affected files without a reliable recovery path, increasing the potential impact of an attack. The information and analysis presented are based on their research and findings.

For MSSPs in particular, the ability to proactively hunt for attacker infrastructure and emerging campaigns can mean finding threats before they become major incidents. Threat intelligence feeds give security teams a way to make threat hunting more continuous and scalable.

Customers expect their security provider to identify threats before they result in disruption, data loss, or costly incident response. That means an MSSP team needs to do more than respond to alerts generated by individual customer environments.

It has to understand what attackers are doing outside those environments and use that intelligence to look for relevant activity inside them. Recent research into IronChain illustrates how quickly ransomware (software that locks up files and demands payment) can turn into a broader business continuity problem.

Key facts

• The research also — found: that the malware’s encryption design may leave affected files without a reliable recovery path, increasing the potential impact of an attack