CAT 510 - Introduction to Ransomware Investigations

Course Description

This course covers the fundamentals of ransomware investigations, including the ransomware threat landscape, common attack methods, victim impact, evidence sources, and investigative workflows. Students are introduced to the ransomware attack lifecycle, common tactics, techniques, and procedures used by threat actors, initial response priorities, evidence preservation, and cryptocurrency-related considerations. The course also examines the challenges associated with attribution, ransom payment demands and documenting investigative findings. Students can expect hands-on cyber range exercises involving simulated ransomware incidents, where they will review incident timelines, identify indicators of compromise, analyze ransomware-related artifacts and logs, preserve digital evidence, and organize their findings into a structured investigative report.

Course Details

By the completion of this course, successful students will be able to:

Skills Acquired:

• Understanding of ransomware operations and common attack patterns
• Ability to identify key evidence sources in ransomware investigations
• Knowledge of initial response and evidence preservation procedures
• Familiarity with cryptocurrency-related investigative considerations
• Ability to document findings in a structured investigative format

Course Components:
Lectures (Theory Component):

• Introduction to Ransomware and Extortion-Based Cybercrime
• Ransomware Attack Lifecycle and Common Tactics, Techniques, and Procedures
• Initial Response Considerations for Investigators
• Evidence Sources in Ransomware Cases
• Cryptocurrency, Payment Demands, and Attribution Challenges

Cyber Range-Based Labs (Hands-On Component):

• Reviewing a Simulated Ransomware Incident Timeline
• Identifying Indicators of Compromise
• Analyzing Ransom Notes, Logs, and System Artifacts
• Preserving Evidence in a Simulated Ransomware Case
• Mapping Findings to a Structured Investigative Report