Name: Turning Intelligence into Action: Disrupting Human-Operated Ransomware Attacks
Start: 2025-08-13T13:00:00Z
End: 2025-08-13T13:00:24.000Z
Location: BrightTALK
Rating: 4.2

EclecticIQ is a global provider of threat intelligence technology and services. Guided by our values — being curious, bold, accountable, and collaborative —  we help security teams make smarter, faster decisions with dynamic solutions that reduce complexity and streamline threat detection and response. From our AI-embedded threat intelligence platform to our browser extension, our products improve workflows, reduce analyst fatigue, and empower customers to neutralize critical cyber threats to their business.

Threat actors are using AI to supercharge their attacks in frighteningly effective ways; automating ransomware, deploying highly convincing phishing emails at scale, and exploiting vulnerabilities in a fraction of the time. 

According to a recent report by ESG, commissioned by EclecticIQ, “42% of security teams are struggling to monitor a changing attack surface.”

So, how can we, as defenders, stand up to this new threat reality, and how do we realize the efficiency gains AI promises, whilst maintaining customer trust and the highest ethical standards? 

Join us for a panel discussion with Ujval Bucha, CPO, and James O’Connor, VP Systems Engineering, at EclecticIQ, where we’ll discuss the following topics:

• How adversaries are weaponizing AI 
• The future of agentic AI in threat intelligence
• Navigating the trust challenge
• How to maximize CTI with an AI-driven approach

Register now to book your spot.

The Weaponization of AI & Implications for Defenders

Join leading cybersecurity experts from the CTI-AI project consortium (EclecticIQ, Łukasiewicz-AI, and NRD Cyber Security) as they explore how artificial intelligence is revolutionizing Cyber Threat Intelligence (CTI) across Europe. The CTI-AI project, part-funded by the European Union, aims to optimize the scalability of cybersecurity resources and advance the maturity of Security Operation Centre (SOC) and CTI operations across Europe through AI-enhanced technologies and methodologies. 

This webinar brings together industry, academic, and consulting perspectives to demonstrate practical AI applications that help organizations "do more with less" while enhancing threat detection, analyst scalability, and intelligence sharing maturity. 

- Understand how the CTI-AI project aims to enable the European cybersecurity community by enhancing capabilities throughout the entire CTI lifecycle 
- Discover current threat intelligence challenges, cutting-edge academic research, and real-world AI implementations  
- Learn actionable strategies for integrating AI into your cybersecurity program, whether you're defending national infrastructure or private sector assets 

This webinar is essential viewing for SOC managers, CTI analysts, and cybersecurity leaders seeking to leverage AI for enhanced operational efficiency.

AI-Powered CTI Excellence: Transforming European Cybersecurity Operations

For modern enterprise organizations a strong and proactive cybersecurity posture means taking threats seriously wherever they emanate from. Region-specific intelligence should not be considered a supplement, but a competitive advantage in a globally connected risk environment. 

Join EclecticIQ and TeamT5 for this webinar on Wednesday, 9th July, to explore how and why your organization should incorporate region-specific threat intelligence into your strategy to ensure a truly global picture of the threat landscape, enabling you to stay one step ahead of malicious actors. 

Key topics: 

- The strategic value of regional intelligence 
- The importance of threat intelligence from Asia-Pacific to European and US organizations 
- How to achieve faster identification of relevant threats and enhance threat hunting capabilities 
- Building a stronger security posture against APAC-specific threat actors

Strategic Intelligence: Translating APAC Threats to Business Risk

In today's cybersecurity landscape, teams aren't starving for data they're drowning in it. What separates high-performing security teams isn't more alerts or feeds, but the critical context that transforms raw data into actionable intelligence. This webinar explores how threat intelligence enrichment and advanced sandboxing create the context advantage that empowers both lightning-fast incident response and forward-thinking threat hunting.

Key Topics:

- The Context Crisis: Why more data often means more confusion; how alert fatigue and "analysis paralysis" are leaving organizations vulnerable despite massive investments in security tools

- The Context Advantage: How enriched threat intelligence and behavioral analysis create the critical connective tissue between isolated data points, revealing the complete attack story

- Putting Context to Work: Step into the day-to-day of a CTI or SOC analyst to see how contextual intelligence supports their workflow, from ingesting threat feeds and detonating files to connecting signals and preparing for response.

- Live Solution Demo & Expert Q&A: Watch us transform a suspicious file into a fully contextualized incident with clear remediation steps, then get your specific challenges addressed by our specialists

The Context Advantage: From Drowning in Data to Decisive Defense

Are your security defenses ready to counter the latest nation-state attack techniques?

Since late 2023, Russia's elite Sandworm (APT44) team has been executing a sophisticated cyber espionage campaign with devastating effectiveness. By strategically trojanizing Microsoft KMS activation tools and disguising malware as Windows updates, they've created an extensive foothold across Ukrainian government, critical infrastructure, and business networks.

On 25 March at 3:00pm CET, Arda Buyukkaya, Senior Threat Analyst at EclecticIQ, will reveal Sandworm's exploitation of Ukrainian software piracy, the technical intricacies of their BACKORDER loader and Dark Crystal RAT, and why current security defenses are falling short.

Why you can't afford to miss this webinar:

1. Actionable Defenses: Walk away with specific SIGMA & YARA rules you can implement immediately to detect Sandworm's activities in your environment.
2. Insider Analysis: Get a rare technical deep-dive into how nation-state actors leverage Living Off the Land Binaries (LOLBINs) to disable security tools and maintain persistence.
3. Strategic Intelligence: Understand the attribution evidence linking this campaign to Russian military intelligence, including infrastructure reuse patterns and malware fingerprints.
4. Practical Recommendations: Receive tailored mitigation strategies that work even in resource-constrained environments.

Whether you're a frontline security analyst, threat hunter, or security leader, this session delivers the technical insights and actionable intelligence you need to strengthen your defenses against threat actors.

Join us to help stay ahead of these evolving tactics.

Sandworm’s Cyber Espionage: Russia’s GRU-Linked APT Uses Pirated Software in Ukraine

Drowning in threat data? It’s time to cut through the noise.

Cyber Threat Intelligence (CTI) teams are often overwhelmed by a sea of alerts and indicators—making it nearly impossible to pinpoint the real threats. In fact, recent studies show that over 70% of cybersecurity experts admit they have missed, ignored, or failed to respond to high-priority security alerts. 

Such lapses can result in substantial financial losses and reputational damage for enterprises. 

A significant contributor to this problem is where intelligence requirements (IRs) often lack the crucial business context needed to identify what truly matters to your organization. However, Artificial Intelligence (AI) is changing the game. By automatically analysing vast amounts of threat data, cross-referencing it with well-defined IRs, and factoring in your unique risks and assets, AI delivers clear, actionable insights and the “why” behind them.

Stop chasing noise. Start making intelligence work for you.  Join Ujval Bucha, Chief Product Officer at EclecticIQ to learn how CTI teams can better integrate AI-driven analytics into their existing CTI processes. 

Key Takeaways: 

- The Power of Context-Driven AI: Better provide clear, actionable insights, including the reasoning behind them based on your organization's unique risks and assets.

- Actionable Intelligence: Instead of chasing endless noise, focus on what matters most: making threat intelligence more effective, returning a clear assessment on relevance, complete with a human-readable explanation.

- Integration of AI into CTI Processes: Streamlining the analysis process, reducing alert fatigue, and enabling quicker, more informed responses to threats.

- Demonstrate and Communicate Value:  Learn reporting techniques to effectively showcase AI-assisted threat verdicts, proving how your CTI program delivers tangible outcomes; reducing risk, aligning with business needs, and optimizing your analysts’ time.

Needle-Sharp CTI: AI for Business-Aligned Threats

Digital ecosystems are expanding at an unprecedented pace, leaving security teams scrambling to map and defend territories they barely understand. As organizations embrace cloud migrations, IoT deployments, and remote work infrastructures, the attack surface grows exponentially—creating blind spots where threats can lurk undetected for months before striking.

Without structured intelligence gathering and vulnerability assessment frameworks, security teams face a losing battle. They cannot distinguish critical vulnerabilities from minor issues and risk misallocating precious resources on low-impact remediation efforts. A comprehensive strategy changes everything—enabling real-time security posture adjustments that balance robust protection with business continuity, ensuring organizations stay resilient against emerging threats.

Join Vincent Amanyi, Founder of Boleaum Inc., to explore proven methodologies for building and implementing an intelligence-driven vulnerability management program that strengthens your organization's security posture.

Key Takeaways:

- Develop a comprehensive framework for conducting thorough environment assessments that identify hidden vulnerabilities across your enterprise
- Learn techniques for prioritizing vulnerability remediation based on actual risk to critical business assets
- Discover strategies for selecting and integrating vulnerability management tools that align with your specific technology stack and ecosystem
- Implement intelligence-gathering processes that provide actionable insights to drive effective vulnerability management
- Create metrics and reporting mechanisms that demonstrate security improvement and support executive decision-making

Strategic Enterprise Intelligence: Mastering Vulnerability Management

With threats like AI-assisted campaigns outpacing traditional security, a proactive approach is essential. Based on new Unit 42 research, this session shows how to stop advanced attacks with a combination of threat intelligence, automation, and AI. Discover how Palo Alto Networks Managed Services (MDR & MTH) on the Cortex SOC platform delivers the visibility and speed needed to drastically reduce MTTR and prevent breaches.

From Insight to Action: A Unit 42 Playbook for AI-Driven Managed Defense

The average enterprise now relies on dozens of third-party SaaS platforms—CRM, HRIS, collaboration suites, developer pipelines—yet most of these cloud-hosted products ship with little or no native threat-detection capability. Attackers know it. OAuth token theft, shadow admin escalation, malicious app implants, and data exfiltration via “legitimate” business workflows routinely bypass perimeter controls and SIEM parsers built for on-prem systems.

This webinar dissects the unique security gaps that arise when your critical data and business logic reside in someone else’s multi-tenant codebase.

Tackling Threat Detection and Response in SaaS Applications

In today’s rapidly evolving cyber threat landscape, organizations must move beyond basic security monitoring and embrace a proactive, intelligence-driven approach to threat detection and response. 

This presentation explores the essential components of building a modern detection and response program—from gaining meaningful visibility across systems to taking decisive, automated action against threats. Attendees will learn how to design a scalable and resilient framework that integrates people, processes, and technology to detect threats early, respond effectively, and continuously adapt to new risks. 

Whether you're establishing a new program or maturing an existing one, this session provides practical guidance, real-world examples, and strategic insights to strengthen your organization’s cyber defense posture.

From Visibility to Action: Designing an Effective Threat Detection and Response Program

With cyber threats on the rise, it’s imperative that organizations have a structured plan to identify and respond to threats.

Many organizations stop once they have procured and deployed security tools, but it often takes a team to operationalize those tools in order to successfully detect and remediate threats.
Join Kevin Gee, Principal Product Marketing Manager at Bitdefender, as he walks through the options available to organizations for addressing cyber threats. He’ll provide a framework for thinking about what it takes to build a cybersecurity program, and the factors organizations must consider when calculating the various costs.

In this webinar you’ll learn:
• The various options organizations implement to address cyber threats.
• All the cost factors to consider across each option
• How to establish a baseline for comparing costs
• Predicting the cost of possible breaches
• The cost of building a team
• The cost value and benefits of an MDR

Determining the cost of a SOC and calculating the value of an MDR

Phishing remains one of the most effective cyberattack methods and it’s evolving fast. So far, in 2025 we’ve seen attackers deploy more sophisticated attacks, leveraging AI, geopolitical tensions, social engineering and new digital channels to target individuals and organisations across EMEA.

Proofpoint’s Carl Leonard, EMEA Cybersecurity Strategist, and Davide Canali, Threat Research Director, are back with an update on the 2025 threat landscape. They’ll be joined by Haifa Ketiti, Staff Sales Engineer, and Anna Akselevich, Threat Researcher, with real-life case examples from the field.

We’ll review the threat landscape across EMEA with special interest to developments in the Middle East. With increased digitalisation and geopolitical instability in this region, threat actors - both state-sponsored and criminal - are launching sophisticated phishing campaigns that ripple across Europe. 

Join our cybersecurity experts as they uncover with real examples the most cunning types of phishing attacks threatening organisations today, including:
• Business Email Compromise (BEC): still the silent assassin, now enhanced with AI-generated messages and deepfake audio.
• Credential Phishing: targeting cloud platforms and collaboration tools like Teams and SharePoint.
• AitM (Adversary-in-the-Middle) phishing: the growing availability of kits and services that bypass Multi-Factor Authentication (MFA) 
• Brand Impersonation: exploiting trust in consumer-facing brands to lure users into clicking.
• Smishing and Vishing: expanding beyond email to mobile and voice channels.

…and more!

Make sure your users don’t get caught in the net with a new wave of phishing attacks in 2025!

Phishing in 2025: AI, Social Engineering & the New Threat Landscape

Building an effective Cyber Threat Intelligence (CTI) program is rarely straightforward. From shifting threat landscapes to internal maturity challenges, even experienced teams can struggle to get it right. 

In this session, we’ll explore the good: what works and why, the bad: common pitfalls and inefficiencies, and the ugly: where CTI efforts often become a liability. Most importantly, we’ll highlight how individuals on the team can play a critical role in driving success by leveraging their unique skills to elevate the entire program. Whether you're building from scratch or looking to fine-tune a mature operation, this talk offers practical insights for making your CTI efforts smarter, stronger, and more impactful.

CTI Teams That Win: Skills, Structure, and Strategy

A lot of hype has recently been showered on AI working in sync with network security perimeter tools with the intention to enhance threat intelligence gathering. Nevertheless, the people aspect of the people-process-technology triad is still vital. Even better, it still works best with open-source threat intelligence. 

In this presentation, industry thought leader Ralph Villanueva will highlight while automating threat intelligence is great, the human factor in gathering timely and critical information from open sources is equally important. Companies cannot simply rely solely on AI algorithms despite the hype.

OSINT Threat Intelligence: Still a Reliable Tool Amidst the AI and Machine Learning Hype

Join SentinelOne's expert security researchers in an insightful webinar that explores the evolving landscape of cyber threats targeting Cloud and AI environments. As organizations rapidly adopt and build with cloud services and AI, new vulnerabilities and attack vectors continue to emerge, posing significant risks to data security and operational continuity.
In this session, SentinelOne researchers will share their latest findings on real-world threats. Discover the tactics, techniques, and procedures (TTPs) used by adversaries, and gain actionable strategies to fortify your defenses.

Cloud Attack and Defend: Emerging Threats

In an era where cyber threats are continually evolving in complexity and frequency, an effective and efficient incident response program stands as a cornerstone of organizational security and resilience. 

Being part of an Incident Response Team during a ransomware attack led to various lessons, and the first 72 hours is where you test all your technical and human capabilities. 

In this presentation, I will share how to change from a traditional playbook to a robust threat intel Incident Response Program. This strategy is based on 3 key integrators: 

- Round-the-clock, automated effective response monitoring of external and internal factors 
- A vigorous brand threat intelligence program 
- Broader integration with risk management, business continuity, and disaster recovery plans

Join this webinar to learn more!

Building a Cyber-Shielded Organization Through a Proactive Incident & Threat Intel Program

When a cyber-attack strikes, the difference between recovery and ruin often hinges on a single factor: integration. Organizations with siloed security operations consistently struggle to contain breaches that seamlessly cross departmental boundaries, costing precious response time and millions in damages.

The challenge lies in breaking down organizational silos and creating an integrated approach that connects operational, tactical, and strategic response capabilities. This becomes particularly critical when managing complex supply chains with multiple third-party dependencies. Modern threat detection and response programs must bridge the gap between cybersecurity and operational resilience, ensuring that organizations can not only detect threats but maintain business continuity when incidents occur.

Drawing from extensive frontline experience, Steve Yates, Chairman of the Resilience Association, will share practical strategies to build a threat response program that seamlessly bridges the critical gap between cybersecurity defences and operational resilience.

Key Takeaways

- Practical strategies for breaking down organizational silos to create an integrated threat response framework
- Key elements of cyber operational resilience and how they complement traditional security approaches
- Frameworks and capabilities needed to manage incidents across complex supply chains with multiple critical third-party dependencies
- Actionable insights for developing a comprehensive incident response strategy that addresses both known and unknown threats

Unifying Cyber & Operational Resilience: Building Robust Threat Response

Building a Solid Threat Detection and Response Program

It’s time to move beyond traditional indicator-based approaches; profiling sophisticated ransomware campaigns requires behavioral analysis. Learn to implement threat-informed detection using open standards like Sigma and YARA, creating robust behavioral detections that outperform signature-based methods.  
 
Join Senior Threat Analyst, Arda Büyükkaya, as he bridges the critical gap between intelligence gathering and operational security, providing practical workflows to enhance your organization's ransomware defense capabilities through intelligence-driven detection.

Turning Intelligence into Action: Disrupting Human-Operated Ransomware Attacks

Threat Analysis

Threat Intelligence

Ransomware

Cyber Security

Emerging Technologies

Eclectic IQ

Security Strategy

Threat Detection

Incident Response

Security Operations

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Turning Intelligence into Action: Disrupting Human-Operated Ransomware Attacks

Presented by

About this talk

EclecticIQ