Cyber Crucible Ransomware Rewind

Data Theft

• Attackers use data-theft malware to steal your data. They threaten to publicize the data theft and sell your data if you do not pay the ransom. If you trust them to behave honorably.

Encryption

• Attackers use ransomware to encrypt your data. If you pay the ransom, you get a buggy decryptor to decrypt your files. Normally, expect a 90%+ chance of losing some files permanently, and losing revenue for around 10 days.

The Ransomware Rewind solution:

Insight

• We use our offensive operational knowledge to determine the attacker techniques and tradecraft used to evade defensive tools prior to data theft.

Analysis

• We build automated solutions that identify these attacker behaviors with high confidence, then freeze the attacker before anything is stolen.

Execution

• High confidence, fully automated ransomware downtime protection. So, the idea is that we have you protected at both stages of extortion.

There Is No Hiding From Our Counter-Extortion Analytics

• Ransomware beating your anti-virus is of no concern for you now, because even 0-day ransomware is stopped in its tracks by our targeted behavioral analytics.

100 Millisecond Response Means Zero Downtime

• Imagine if the first notification of an attack is your phone receiving a message that it was just taken care of!

Remove The Scourge Of Corrupted And Encrypted Files

• Other tools corrupt files or leave them encrypted when they do catch the attack. Not us! Use full automation to prevent access, or quickly decrypt if you want user approval before stopping the attack.

File Behavioral Analysis

• Other products wait for up to 20% of files to be encrypted before notifying. We stop the attacker before the first file is corrupted.

Cryptographic Behavioral Analysis

• As cryptography experts, we use in-memory, file, and operating system techniques to automatically profile encryption behaviors.

Advanced Attacker Behavior Analysis

• Our analytics finds the attackers others miss, and automatically suspend the attackers, despite them usually having disabled other security tools first.