In the movie "The Matrix", finding the "Keymaker" is the key to ending the war. In real life, Initial Access Brokers who provide malicious hackers with access to various enterprises' defense systems have become increasingly active since 2022. They trade effective login credentials in dark web marketplaces. From national-level hackers, ransomware groups to red team service providers, all of them could be potential buyers of those illegal credentials. In many cases of ransomware attacks, achieving initial access is enough to complete their whole destructive incident. The speaker Pei-Kan Tsung (PK) has been analyzing the dark web trading market and the causes of attacking incidents for a long time, and recommends that enterprises should actively seek out the "Keymaker" who can break the locked door of their defense system to proactively prevent potential cyber attacks.

How to fight ransomware has become an essential task, but will using the defense framework make our Cyber defense strategy invincible?

Things may be more complicated than you think. With so many assets to protect, which one has the highest priority?

With so many protection solutions available, which one can effectively defeat the attack?

Therefore, threat intelligence is even more critical than you might realize. Knowing your attackers' IOC, understanding their attack methods, and comprehending their background can help you better defeat them.

In the face of rapidly evolving ransomware attacks in the wild, security majors are promoting the ability of AI to identify and defeat malware in the wild - but is that true? There are benefits and unavoidable limitations to the use of AI technology in the fight against wild samples.

In this session, we will return to the semantics of execution and combine it with the papers on symbolic execution to design a practical symbolic engine that can reverse analyze over a thousand real ransomware samples in the wild to defeat over 95% of them! At the same time, the source code of our engine will be presented at the conference to help vendors understand and use the semantic-aware detection solution based on the symbolic engine, which can effectively combat highly variable obfuscated samples.