Latest / Tech Talks With Kinsoft / Five Eyes Warning – INC Ransom Targets Australian Healthcare

Transcript

Five Eyes Warning – INC Ransom Targets Australian Healthcare · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Imagine you
• 0:03
  are the IT director for like a regional hospital
• 0:06
  network. It is 3 .0 a .m. on a Tuesday and your
• 0:10
  phone rings. Yeah, that is never a good time
• 0:13
  for the phone to ring. No, definitely not. And,
• 0:15
  you know, it is not just a server outage. Every
• 0:17
  emergency room monitor is locked. Patient history
• 0:19
  databases are just completely inaccessible. And
• 0:22
  there is a digital ransom note sitting right
• 0:23
  on your desk. Which is an absolute nightmare
• 0:26
  scenario. Right. But the attackers aren't just
• 0:28
  demanding money to unlock the screens. They are
• 0:31
  threatening to publish 10 ,000 highly sensitive
• 0:33
  psychiatric records on the public internet by
• 0:35
  sunrise if you don't pay. Exactly. And that terrifying
• 0:40
  scenario isn't a hypothetical at all. It is the
• 0:43
  exact operating model of a threat that is actively
• 0:46
  dismantling critical infrastructure right now.
• 0:48
  Yeah. And that operational reality is the entire
• 0:51
  focus of our session today. We are breaking down
• 0:54
  a critical joint cybersecurity advisory issued
• 0:56
  on March 12, 2026. And this warning comes straight
• 0:59
  from the top, right? Oh, absolutely. We are talking
• 1:02
  about the Australian Cyber Security Center, the
• 1:04
  ACSC, working in tandem with New Zealand's NCSC
• 1:09
  and CERT Tonga. They are sounding a massive alarm
• 1:12
  about a group known as INC Ransom. Right. And
• 1:15
  their relentless campaign against Australian
• 1:18
  health care and critical infrastructure across
• 1:20
  the Pacific. OK, let's unpack this, because to
• 1:23
  actually defend against this group, we have to
• 1:25
  understand their specific business model. I mean,
• 1:27
  who exactly is INC Ransom? And what is the true
• 1:30
  scale of the damage outlined in this advisory?
• 1:33
  Well, in the threat intelligence community, you
• 1:35
  will sometimes see INC ransom tracked under names
• 1:37
  like Tarnished Scorpion or Goldie Ionic. Okay.
• 1:42
  Yeah, and the advisory confirms that between
• 1:44
  July 2024 and December 2025, this specific group
• 1:48
  breached at least 11 different Australian organizations.
• 1:51
  Oh, 11. Yeah, 11 confirmed. But looking at that
• 1:54
  number in isolation is actually kind of deceptive.
• 1:56
  Since early 2025, they have aggressively expanded
• 1:58
  their footprint into the broader Pacific. Right,
• 2:01
  because the advisory mentioned New Zealand and
• 2:02
  Tonga. Exactly. They successfully disrupted vital
• 2:05
  health networks there. And they are not just...
• 2:09
  you know, spraying and praying, they are systematically
• 2:12
  targeting health care and professional services.
• 2:14
  I mean, 11 confirmed major breaches of critical
• 2:17
  infrastructure in an 18 month window is a staggering
• 2:20
  success rate for one group. It really is. It
• 2:23
  kind of begs the question of how they are scaling
• 2:26
  so rapidly. The advisory points out that INC
• 2:29
  Ransom utilizes a ransomware as a service model
• 2:32
  or RAHAS. I've heard it described as a franchise
• 2:35
  model for cybercrime. Yeah, that's a great way
• 2:37
  to put it. Yeah. Where developers basically rent
• 2:39
  out their malware toolkits to less sophisticated
• 2:42
  criminals, which massively lowers the barrier
• 2:44
  to entry. If they are essentially franchising
• 2:48
  this out, does this mean we are facing a much
• 2:50
  higher volume of attacks rather than highly sophisticated
• 2:53
  targeted ones? What's fascinating here is how
• 2:56
  this RIS model turns cybercrime into a highly
• 3:00
  scalable, almost industrialized business supply
• 3:03
  chain. I mean, in the old days, a hacker had
• 3:05
  to be a master of everything. Right. They had
• 3:07
  to build it all from scratch. Exactly. They had
• 3:09
  to write the exploit, breach the network, build
• 3:11
  the encryption algorithm, and figure out how
• 3:13
  to collect the money. INC Ransom just splits
• 3:16
  that workload. So they specialize. Yeah. The
• 3:19
  core developers act like a Silicon Valley SaaS
• 3:21
  startup. They build the backend infrastructure,
• 3:24
  the encryption tools, the dark web leak sites,
• 3:27
  and the payment portals. That is wild. They even
• 3:30
  provide IT help desks support for their victims.
• 3:33
  Like they offer live chat to walk a hospital
• 3:36
  administrator through the process of acquiring
• 3:38
  Bitcoin. Are you serious? Live chat support.
• 3:41
  So they really operate with the efficiency of
• 3:44
  a legitimate corporation. Completely. And instead
• 3:47
  of launching the attacks themselves, they lease
• 3:49
  that entire back end to affiliates. And these
• 3:52
  affiliates are basically independent contractors.
• 3:54
  OK, so the affiliates do the actual breaking
• 3:56
  in. Yes. They don't need to know how to code
• 3:59
  complex malware. They just need to know how to
• 4:01
  break into a network. Once they in, they deploy
• 4:05
  the least INC ransom toolkit. And then they just
• 4:07
  split the profits. Exactly. The core group takes
• 4:11
  a percentage of the final ransom and the affiliate
• 4:13
  keeps the rest. This drastically lowers the barrier
• 4:17
  to entry, flooding the threat landscape with
• 4:19
  financially motivated opportunistic attackers.
• 4:22
  Wow. That volume fundamentally changes the math
• 4:25
  for defenders. I mean, we are no longer trying
• 4:28
  to stop one elite master thief. No. We have to
• 4:31
  defend against 100 opportunistic smash and grabbers.
• 4:35
  Which, you know, brings us to the tactical mechanics
• 4:37
  of the breach. How are these affiliates actually
• 4:40
  getting past the perimeter of highly sensitive
• 4:43
  health care networks? Right. So what does their
• 4:45
  entry strategy look like today? Yeah, exactly.
• 4:47
  Well, the advisory highlights that they rarely
• 4:50
  burn zero day. custom -built exploits to gain
• 4:53
  initial access. They rely on the path of least
• 4:56
  resistance. Which usually means human error,
• 4:58
  right? Usually, yeah. First, they deploy highly
• 5:00
  targeted spear phishing campaigns. And we aren't
• 5:03
  talking about generic spam emails riddled with
• 5:05
  typos. These are sophisticated social engineering
• 5:08
  lures, often tailored specifically to healthcare
• 5:11
  administrators or IT staff, designed to just
• 5:13
  harvest their login credentials. Okay, so phishing
• 5:17
  is step one. What else? Second. They constantly
• 5:19
  scan the public -facing internet for unpatched
• 5:22
  systems. They exploit known vulnerabilities in
• 5:25
  VPNs or remote desktop gateways before the IT
• 5:28
  team even has a chance to apply the latest security
• 5:31
  update. Wow. But the advisory also mentions something
• 5:34
  that feels much harder to defend against, which
• 5:38
  is initial access brokers. Oh, yeah. That is
• 5:41
  perhaps the most concerning vector. Really? Definitely.
• 5:43
  The cybercrime economy is so specialized now
• 5:46
  that there's an entire sub -industry of initial
• 5:48
  access brokers, or IABs. And what do they do
• 5:51
  exactly? These are threat actors whose only job
• 5:53
  is to compromise network credentials. They usually
• 5:56
  do this through massive automated credential
• 5:58
  stuffing attacks or by purchasing logs from info
• 6:01
  -stealing malware. Okay, so they just steal the
• 6:03
  passwords. Right, but they don't deploy ransomware.
• 6:05
  They simply take that working username and password,
• 6:08
  package it, and sell it on dark web forums to
• 6:10
  a ROS affiliate. oh wow so the affiliate just
• 6:13
  buys the password logs into the hospital's vpn
• 6:16
  and bypasses the external perimeter entirely
• 6:19
  exactly why bother breaking a window when you
• 6:23
  can literally just buy the key to the front door
• 6:25
  online that is absolutely terrifying okay so
• 6:28
  the affiliate has purchased the credentials they
• 6:31
  have logged into the network and maybe they are
• 6:34
  sitting on like a receptionist's computer What
• 6:38
  happens next? Well, sitting on a receptionist's
• 6:40
  computer doesn't get them the millions of dollars
• 6:42
  they want. Yeah, obviously not. That local machine
• 6:45
  doesn't have access to the core patient databases,
• 6:47
  and it certainly doesn't have the permissions
• 6:49
  required to deploy ransomware across the entire
• 6:52
  organization. So they have to move. The advisory
• 6:54
  emphasizes lateral movement and privilege escalation.
• 6:57
  Exactly. They need to move laterally from that
• 7:00
  initial entry point, jumping from workstation
• 7:03
  to server, just hunting for the network's central
• 7:05
  nervous system, which... in most enterprise environments,
• 7:09
  is the domain controller. Right, the domain controller.
• 7:12
  I hear that term thrown around constantly in
• 7:14
  these advisories. Let's break down mechanically
• 7:17
  why it is the ultimate prize for these affiliates.
• 7:20
  So the domain controller runs Active Directory.
• 7:23
  It is the system that basically dictates who
• 7:26
  gets access to what. It holds the cryptographic
• 7:29
  hashes for every password and manages the permissions
• 7:32
  for every user and device on the network. Okay,
• 7:35
  so it's the master key. Essentially, yes. If
• 7:38
  an attacker can escalate their privileges and
• 7:40
  compromise the domain controller, they rewrite
• 7:42
  the rules of the network. They can grant themselves
• 7:44
  permanent, invisible administrative access. Wow.
• 7:48
  And more importantly, instead of having to manually
• 7:50
  hack 5 ,000 individual hospital computers one
• 7:53
  by one, they can use the domain controller to
• 7:56
  push their ransomware out to every single machine
• 7:58
  simultaneously. Almost as if it were a legitimate
• 8:01
  company -wide software update. But to pull that
• 8:04
  off, they need a significant amount of time inside
• 8:06
  the network without getting caught. And here's
• 8:08
  where it gets really interesting. The ACSC advisory
• 8:11
  explicitly warns that INC ransom affiliates use
• 8:15
  legitimate, everyday IT tools to avoid detection.
• 8:18
  Yeah, that's a huge problem for defenders. I
• 8:20
  mean, we are talking about software like 7 -Zip,
• 8:23
  which is a standard file archiving tool, and
• 8:26
  SirClone, which is used to sync data to cloud
• 8:29
  storage. But I am stuck on this concept. How
• 8:31
  so? Well, it's like a burglar wearing a utility
• 8:34
  company uniform to walk right past the security
• 8:37
  cameras. If they are using the exact same tools
• 8:39
  that our IT departments use every day, how can
• 8:42
  a defender possibly spot them without shutting
• 8:44
  down normal, legitimate operations? That is the
• 8:48
  exact dilemma defenders face, and it's a a tactic
• 8:50
  known as living off the land. Living off the
• 8:52
  land, okay. Yeah. If an attacker brings custom
• 8:54
  known malware into your environment, an endpoint
• 8:56
  detection system will flag the malicious signature
• 8:59
  immediately. It is noisy. Right, the alarms go
• 9:02
  off. But a tool like 7 -Zip has no malicious
• 9:05
  signature. It is a trusted, digitally signed
• 9:08
  application. The security software sees a legitimate
• 9:11
  tool doing exactly what it was programmed to
• 9:14
  do, which is compress files. Okay, so the software
• 9:16
  just ignores it. Exactly. To spot the attacker,
• 9:19
  defenders have to shift their focus from looking
• 9:21
  at the tool to analyzing the behavior. So it
• 9:24
  is not about what the tool is. It is about context.
• 9:26
  It's analyzing who is using it, when they are
• 9:29
  using it, and what they are applying it to. Precisely.
• 9:32
  Behavioral heuristics look for anomalies. An
• 9:35
  IT admin using 7 -zip during standard business
• 9:38
  hours to compress a small folder of text files
• 9:41
  is normal behavior. Right. But if 7 -zip is suddenly
• 9:44
  executed at 2 .0 AM, by a service account that
• 9:47
  normally doesn't interact with the desktop, and
• 9:50
  it is using command line arguments to compress
• 9:52
  500 gigabytes of data from a highly sensitive
• 9:55
  SQL Server database. Yeah, that is a red flag.
• 9:58
  Exactly. That combination of the behaviors should
• 10:00
  trigger an immediate high -priority alert in
• 10:02
  a modern security operations center. That makes
• 10:04
  perfect sense. So the affiliate is living off
• 10:07
  the land. using seven zip to quietly bundle up
• 10:10
  these massive databases and then using a tool
• 10:13
  like sir clone to siphon that data out of the
• 10:15
  network it's disguised as regular outbound cloud
• 10:18
  traffic right And they are going through this
• 10:21
  incredibly complex, stealthy process before they
• 10:24
  ever drop the actual ransomware. I mean, this
• 10:26
  completely changes the narrative of what ransomware
• 10:29
  even is. It really does. We have firmly left
• 10:32
  the era where the primary goal was simply locking
• 10:35
  computers. We are operating in the reality of
• 10:38
  double extortion. And the advisory makes this
• 10:40
  crystal clear. INC ransom isn't just freezing
• 10:43
  systems to halt operations. They're exfiltrating
• 10:46
  the data first. Yes, the data theft is key. And
• 10:48
  in the context of the Australian health networks
• 10:50
  they have breached, we are talking about highly
• 10:52
  personal, confidential medical histories, diagnostic
• 10:55
  imaging, and psychiatric evaluations. Which provides
• 10:58
  them with an insurmountable level of leverage.
• 11:00
  Definitely. They steal the data, they deploy
• 11:03
  the locker to paralyze the hospital, and then
• 11:05
  they deliver the ultimatum. Like, pay the first
• 11:07
  ransom to get the decryption key so you can turn
• 11:10
  your monitors back on, and pay the second ransom
• 11:12
  to stop us from dumping your patient's most intimate
• 11:15
  medical secrets onto the dark web. This is why
• 11:18
  health care is not an accidental target for this
• 11:20
  RAS ecosystem. It is a deeply cynical, highly
• 11:24
  calculated strategy based on operational pressure.
• 11:28
  Because they can't afford to be offline. Exactly.
• 11:30
  If a manufacturing plant is locked out of its
• 11:33
  systems, it is a massive financial headache.
• 11:35
  They lose revenue every hour the assembly line
• 11:38
  is down. Right. But if a hospital is locked out
• 11:40
  of its systems, the stakes immediately become
• 11:42
  physical. Operational downtime means diverted
• 11:45
  ambulances, delayed surgeries, and doctors unable
• 11:48
  to access critical allergy information before
• 11:50
  administering medication. So what does this all
• 11:53
  mean? It feels like they are weaponizing the
• 11:55
  very mission of health care providers against
• 11:57
  them. How does an organization even begin to
• 12:01
  calculate the risk when human safety is on the
• 12:03
  line? If we connect this to the bigger picture,
• 12:06
  this advisory forces us to re -evaluate our definition
• 12:10
  of critical infrastructure vulnerabilities. So?
• 12:12
  Well, for decades, a cyber breach was viewed
• 12:16
  through the lens of data privacy or financial
• 12:18
  loss. It was an IT problem handled by the IT
• 12:21
  department. Right, just a tech issue. Yeah, but
• 12:24
  when an affiliate buys a stolen password for
• 12:26
  $50 and uses it to bring regional patient care
• 12:29
  to a grinding halt, it ceases to be an IT issue.
• 12:33
  It becomes a systemic public safety crisis. Absolutely.
• 12:37
  It proves that the physical resilience of our
• 12:38
  society is now entirely dependent on the digital
• 12:41
  resilience of these networks. So focusing on
• 12:43
  the organizations listening to this right now,
• 12:45
  we understand the severity. We know INC Ransom
• 12:48
  scales through a franchise model. We know they
• 12:50
  buy credentials, move laterally to the domain
• 12:53
  controller, live off the land with 7 -zip distilled
• 12:55
  data, and then execute double extortion. The
• 12:58
  critical question now is defense. Right. How
• 13:01
  do we stop them? Exactly. Based on this joint
• 13:04
  advisory, how do Australian critical infrastructure
• 13:06
  providers actually build a shield against a threat
• 13:09
  that is this multifaceted? Well, the beauty of
• 13:12
  this advisory is that it functions as a highly
• 13:14
  actionable defense playbook. It outlines specific
• 13:18
  countermeasures designed to break the attacker's
• 13:21
  kill chain at every single stage we just discussed.
• 13:23
  OK, so where do we start? It starts at the very
• 13:25
  beginning, which is initial access. Since we
• 13:29
  know affiliates rely heavily on purchased credentials
• 13:31
  from initial access brokers, organizations have
• 13:34
  to render those stolen passwords useless. But
• 13:37
  the standard advice is always, you know, use
• 13:39
  stronger passwords or enforce credential hygiene.
• 13:42
  But if an attacker is literally buying my password
• 13:45
  on the dark web. It doesn't really matter if
• 13:48
  it has 20 characters and a dozen special symbols,
• 13:50
  right? If they have it, they have it. It sounds
• 13:52
  like we have to assume they already have the
• 13:54
  keys to the front door, which means we need significantly
• 13:57
  smarter locks on the inside. Which is exactly
• 14:00
  why the advisory heavily emphasizes the deployment
• 14:02
  of phishing -resistant multi -factor authentication,
• 14:05
  or MFA, on all external facing services. Phishing
• 14:09
  -resistant MFA. Yes, and the distinction of phishing
• 14:11
  -resistant is critical here. I want to pause
• 14:13
  on that because it's a vital point. A lot of
• 14:15
  organizations think they are secure because they
• 14:18
  use SMS text messages or app -based push notifications
• 14:22
  for MFA. Why aren't those standard methods enough
• 14:26
  to stop an INC ransom affiliate? Because the
• 14:29
  attackers have adapted. Affiliates now use adversary
• 14:33
  -in -the -middle proxy attacks. What does that
• 14:35
  look like? Let's say you click a sophisticated
• 14:37
  phishing link. It takes you to a fake login page
• 14:40
  that looks exactly like your corporate Microsoft
• 14:42
  365 portal. You type your password. Okay. The
• 14:46
  fake site then prompts you for your SMS code.
• 14:48
  You look at your phone, type in the six digits,
• 14:50
  and hit enter. In milliseconds, the proxy server
• 14:53
  captures that code and forwards it to the real
• 14:55
  Microsoft site, logging the attacker in. Oh,
• 14:58
  wow. Yeah. They bypass your SMS MFA in real time.
• 15:02
  So what makes something genuinely phishing -resistant
• 15:04
  then? Physical cryptography. Yeah. Phishing -resistant
• 15:07
  MFA, like FIDO2 hardware security keys, which
• 15:10
  is a physical USB device you plug into your laptop,
• 15:13
  relies on cryptographic proof. Okay, so it's
• 15:15
  a physical thing. Exactly. The hardware key authenticates
• 15:19
  the physical domain you are visiting. If you
• 15:21
  are on a fake proxy site, the hardware key recognizes
• 15:25
  the domain mismatch and simply refuses to hand
• 15:28
  over the cryptographic token. That is brilliant.
• 15:31
  Yeah. The authentication fails. Even if the affiliate
• 15:34
  buys your password, without that physical piece
• 15:36
  of hardware, they cannot get through the VPN.
• 15:39
  That makes a massive difference. But let's assume
• 15:41
  the worst case scenario here. Let's assume an
• 15:43
  affiliate somehow finds a gap, maybe an unpatched
• 15:46
  legacy server, and gets a foothold inside the
• 15:49
  network. We know their next step is hunting for
• 15:51
  the domain controller. How do we stop that lateral
• 15:55
  movement? Defenders must implement the principle
• 15:58
  of least privilege and aggressively limit privilege
• 16:01
  escalation paths. Meaning what, practically?
• 16:03
  You have to design the network with the assumption
• 16:05
  that a breach will occur. If a standard user
• 16:08
  account is compromised, that account should be
• 16:10
  locked down in a segmented environment. It should
• 16:13
  not have the ability to run administrative scripts,
• 16:16
  access sensitive file shares, or communicate
• 16:18
  with the domain controller over unnecessary ports.
• 16:22
  You isolate the infection by moving the pathways
• 16:24
  the attacker needs to travel. You are essentially
• 16:27
  building bulkheads in a submarine. Like if one
• 16:30
  compartment floods, the ship doesn't sink. That's
• 16:32
  a perfect analogy, yeah. And what about the stealth
• 16:34
  phase where they are using 7 -Zip and SirClone?
• 16:38
  We talked about behavioral heuristics earlier.
• 16:40
  Right. Organizations must deploy advanced endpoint
• 16:42
  detection and response, or EDR, solutions that
• 16:45
  monitor behavior, not just file signatures. So
• 16:48
  the software has to be smart enough to catch
• 16:50
  the contact. Exactly. And you need a security
• 16:53
  operations team or a managed service provider
• 16:56
  actively hunting for those anomalies we discussed.
• 16:58
  If AirClone suddenly starts initiating massive
• 17:01
  outbound data transfers to a cloud storage provider
• 17:04
  your company doesn't use, the network should
• 17:06
  automatically sever that connection. Finally,
• 17:09
  the advisory tackles the grim reality of incident
• 17:12
  response readiness. If the behavioral monitoring
• 17:14
  fails and the data is successfully exfiltrated,
• 17:18
  what is the protocol? This raises an important
• 17:21
  question. Is your organization truly ready for
• 17:25
  an incident response where the data is already
• 17:27
  gone rather than just encrypted? Because backups
• 17:30
  don't solve the problem anymore. Exactly. In
• 17:32
  a double extortion scenario, pristine offline
• 17:35
  backups will help you restore your systems, but
• 17:39
  they will not unsteer your data. Right. The data
• 17:42
  is still out there. Yeah. Your incident response
• 17:44
  playbook cannot just be an IT recovery manual.
• 17:47
  It must include legal counsel. public relations
• 17:50
  strategies, regulatory notification procedures,
• 17:53
  and clear communication plans for the patients
• 17:56
  whose data has been compromised. It becomes a
• 17:58
  whole of business crisis. It really does. The
• 18:00
  overarching lesson is that proactive defense,
• 18:02
  buying the hardware keys, segmenting the network,
• 18:04
  paying for behavioral monitoring is infinitely
• 18:07
  cheaper and less damaging than trying to manage
• 18:09
  the fallout of highly sensitive medical records
• 18:11
  hitting the dark web. It is just a vicious industrialized
• 18:15
  cycle. And the only way to disrupt it is by making
• 18:17
  the initial breach too complex. costly, too complex,
• 18:20
  and too time -consuming for the affiliates to
• 18:22
  bother with. We have covered a tremendous amount
• 18:25
  of ground in this session. We really have. To
• 18:27
  quickly recap our exploration for you, we dissected
• 18:30
  the March 2026 joint advisory from Five Eyes
• 18:34
  partners detailing the INC ransom threat. We
• 18:38
  broke down their ransomware as a service business
• 18:40
  model, exploring how they utilize initial access
• 18:43
  brokers to scale attacks against Australian and
• 18:45
  Pacific critical infrastructure. Right. relying
• 19:07
  on behavioral monitoring to catch what traditional
• 19:09
  antivirus misses. The complexity of the threat
• 19:12
  demands a matching level of sophistication in
• 19:14
  our defense. And building on everything we've
• 19:16
  explored, I want to leave you with a final thought
• 19:18
  to consider. Okay, let's hear it. We spent this
• 19:20
  session detailing how ransomware groups are successfully
• 19:23
  franchising their operations, right? They share
• 19:25
  initial access, lease backend infrastructure,
• 19:27
  and collaborate to scale their attacks. Yeah,
• 19:30
  highly collaborative. If the adversaries are
• 19:32
  collaborating this efficiently, are we doing
• 19:35
  enough to franchise our defense? How can organizations,
• 19:38
  particularly within the healthcare sector, better
• 19:40
  share threat intelligence, behavioral detection
• 19:42
  rules, and incident response playbooks in real
• 19:45
  time so that an attempted breach on one regional
• 19:48
  hospital automatically translates into an impenetrable
• 19:51
  defense for all the others? Wow, that is a phenomenal
• 19:54
  challenge to end on. The cybercrime economy is
• 19:57
  networked, so our defensive posture must be equally
• 20:00
  collaborative. If you are listening to this session
• 20:02
  and realize your organization needs to take these
• 20:05
  warnings to heart, if you need to... ensure your
• 20:07
  critical infrastructure, your patient data, and
• 20:09
  your operational resilience are protected against
• 20:12
  highly motivated threat ecosystems like INC Ransom,
• 20:15
  you cannot wait for the breach to happen. No,
• 20:17
  you absolutely cannot. You need to visit www
• 20:20
  .kinsoft .com .au to discuss your security and
• 20:24
  IT needs. They have the specialized expertise
• 20:26
  required to help you build those internal bulkheads,
• 20:29
  deploy behavioral monitoring, and genuinely secure
• 20:32
  your environment. Achieving resilience against
• 20:34
  double extortion is complex. But with the right
• 20:36
  architectural strategy, it is entirely possible.
• 20:39
  Thank you so much for joining us on this exploration
• 20:42
  of the modern threat landscape. We've loved unpacking
• 20:45
  these insights with you. Stay vigilant, stay
• 20:46
  secure. And remember, we are no longer defending
• 20:50
  against isolated hackers. We are defending against
• 20:52
  an industry. It is time to fortify the network.
• 20:55
  Catch you next time.