Unraveling Rorschach

Checkpoint recently shared a write-up on some newly-discovered ransomware dubbed, "Rorschach". The write-up was pretty interesting, and had a good bit of content to unravel, so I thought I'd share the thoughts that had developed while I read and re-read the article.

From the article, the first things that jumped out at me were:

Check Point Research (CPR) and Check Point Incident Response Team (CPIRT) encountered a previously unnamed ransomware strain...


...and...
While responding to a ransomware case...
So, I'm …

access actions actor article case check check point checkpoint incident incident response incident response team initial access point ransomware research response rorschach share team things thought thoughts threat threat actor write-up