Did you know that @CISAgov's Known Exploited Vulnerabilities (KEV) catalogue includes a "knownRansomwareCampaignUse" field? If you want to pull just the CVEs that have this field set to "Known" (i.e. that have been associated with ransomware activity), I whipped up a 'lil curl command for ya: curl -L for528.com/cves-kev-json | jq -c '.vulnerabilities[] | select(.knownRansomwareCampaignUse == "Known")' Easy peasy! Note: You'll need jq installed (e.g. `sudo apt install jq` in bash). Learn this #ransomware tip and more in our @SANSInstitute | @sansforensics FOR528: Ransomware and Cyber Extortion course -- sans.org/for528

Join @maridegrazia and me for our April '26 Stay Ahead of Ransomware episode April 7th @ 1pm ET. We'll be discussing evolving Initial Access methods: ClickFix & Teams-based vishing. We'll talk prevention, detection, and response. We're even going to show a live demo, then show hands-on response via data we've generated within our FOR528 Windows VM. It's becoming more and more important that you and your org are familiar with these methods. And with ransomware campaigns following on from these methods of access more and more these days, you REALLY want to stop them from hitting your org. Gross. See you soon! #ransomware #clickfix #vishing #phishing #RansomwareSucks

I'll be teaching my @SANSInstitute | @sansforensics FOR528: Ransomware and Cyber Extortion course at the #DFIRSummit 2026 event. Come hang out with me and learn how to prevent, detect, and response to #Ransomware and #CyberExtortion! sans.org/for528 #RansomwareSucks

Ransomware isn’t slowing down — and neither is the need for trained responders. #FOR528: #Ransomware & #CyberExtortion™ has updated pricing to make this critical ransomware response training accessible to more practitioners. Register: sans.org/u/1Db4 @rj_chap

Would LOVE to see YOU at the @SANSInstitute | @sansforensics DFIR Summit 2025, online (FREE!) or in-person. Details in shared post below. I'll be running FOR528: Ransomware and Cyber Extortion live online following the summit. Discount code below! Come hang with us :). #DFIRSummit #FOR528

Learn to respond to ransomware threats like HumOR & RaaS using real-world attacks & forensic artifacts. Take FOR528 at #DFIRSummit w/ @rj_chap next month! 💥 Save $600 w/ code SUMMIT*600 when you register and pay by July 11! 🔗 Register: sans.org/u/1zv0

Thinking about taking the @sansforensics 528 Ransomware course? I love teaching it—not only do we focus on ransomware, but also host-based forensics and analysis at scale. It's great for a wide range of investigations! Use code FOR528-SUMMIT for 30% off sans.org/cyber-security-trai…

🚀 Offer ends Friday! Save $600 thru May 16 on FOR528 at #RansomwareSummit. Use code SUMMIT-600. Strengthen your defense against ransomware⚡ Experience real-world attack simulations for practical hands-on learning. 🔒 Learn More & Register: sans.org/u/1yCa

Prepare yourself with practical simulations at the #RansomwareSummit with our FOR528: Ransomware and Cyber Extortion™ course! 🚀 Save $600 when you register and pay by May 16. Use code: SUMMIT-600 at checkout: sans.org/u/1yCa

Strengthen your defense against ransomware⚡ Dive deeper w/ FOR528: Ransomware & Cyber Extortion to experience real-world attack simulations for practical hands-on learning at #RansomwareSummit! 🚀 Save $600 thru May 16. Use code SUMMIT-600. 🔒 Register: sans.org/u/1yCa

Strengthen your defense against ransomware⚡ Dive deeper w/ FOR528: Ransomware & Cyber Extortion to experience real-world attack simulations for practical hands-on learning at #RansomwareSummit! 🚀 Save $600 thru May 16. Use code SUMMIT-600. 🔒 Register: sans.org/u/1yCa

Strengthen your defense against ransomware⚡ Dive deeper w/ FOR528: Ransomware & Cyber Extortion to experience real-world attack simulations for practical hands-on learning at #RansomwareSummit! 🚀 Save $600 thru May 16. Use code SUMMIT-600. 🔒 Register: sans.org/u/1yCa

Check out Terry's run of #FOR528 following the @SANSInstitute | @sansforensics Ransomware Summit this year! If you're in LE, you can get up to 50% off the class too! Check out sans.org/mlp/state-local-LE-… to learn more!

I am teaching my @SANSInstitute | @sansforensics "FOR528: Ransomware and Cyber Extortion" course online during the SANS Live Online Europe January 2025 event 2025/01/27-01/30! Discounts or free stuff currently if you sign up. See codes & see you during class!

Join @maridegrazia at #DFIRCON Miami 🌴 for FOR528! Learn to prepare for, detect & respond to #ransomware using real forensic data. From initial access to data exfiltration FOR528 covers each phase of the ransomware lifecycle 👉 Secure your spot today!: sans.org/u/1xGA

If you've been waiting to take my @SANSInstitute | @sansforensics "FOR528: Ransomware and Cyber Extortion" course OnDemand, now is the time! You can get an iPad Air, Surface Go 4, or $400 off! Check it out: sans.org/specials/north-amer….

Come take #for528 with me :). It's going to be a BLAST!!

Special #DFIRSummit Offer: Save $600 on all 4-6 day courses at the Summit Register now! 👉sans.org/u/1x6R and pay by August 18, 2024! Use code "LIVEQ324" at check out to take #FOR528: #Ransomware and #CyberExtortion course with @rj_chap #DFIR

Want to learn a ton about Active Directory, including how various attacks work? Check out @zer1t0's FREE "Attacking Active Directory" project: zer1t0.gitlab.io/posts/attac…. Really cool stuff here! #activedirectory #ransomware #RansomwareSucks #for528 #cybersecurity

Yeah buddy! I cover them in FOR528! Easiest to find in the UsnJrnl. LOVE this bad boy!