Thermo Fisher's Matt McKnew on the Evolution of Ransomware as a Service

Future of Threat Intelligence · Mar 5, 2026 · 34m

When Matt McKnew, Senior Manager of Incident Response at Thermo Fisher, tracked down the Nimda worm in 2001 by analyzing packet captures to identify NetBIOS saturation patterns, threat actors weren't trying to get paid; they were causing disruption. Today, he's defending against ransomware groups that operate like businesses, complete with service models and affiliate networks.

Matt explains why Clop's acquisition of six zero-days puts them in APT territory regardless of financial motivation, how attackers now hide in the noise of criminal operations making nation-state activity harder to…