Back to Threat Summit overview
DFIRAttribution
Ransomware Misdirection: When Attribution Isn’t What It Seems
James John
Threat Summit 2026 · Session recording
About this session
A real ransomware investigation where a last-minute change of tactics revealed that a different group was orchestrating the attack. The session explains how intrusion data and custom threat hunting cut through deception to reach true attribution.
Speaker
James John
James is a Chartered Incident Response Professional and SANS-certified DFIR practitioner with more than a decade of experience across criminal and civil forensic investigations in the public and private sectors. James leads Bridewell’s proactive and reactive incident response services across CNI, finance, hospitality, defence, and government for UK and US markets.