Naif Hussain
Senior DFIR
SITE
Naif Hussain is a Senior DFIR Specialist at SITE, leading incident response investigations into sophisticated cyberattacks against critical entities, with hands-on experience responding to ransomware intrusions, data extortion, and APT campaigns. He previously helped build the threat intelligence department at MCIT, developing CTI frameworks for the IT, telecom, and space sectors. He co-founded THINT, the first Saudi threat intelligence platform, and exited in 2025. He holds GCFA, GCTI, GCFE, and OSDA certifications, co-authored a book chapter on AI in cybersecurity, and spoke at Black Hat MEA 2024 on infostealers and the Malware-as-a-Service economy.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
The Business of Fear: Inside the Ransomware-as-a-Service Economy
Ransomware is no longer a malware problem. It is a supply chain, and in 2026 it is the most efficient criminal industry ever built.This session dissects that industry end to end. It opens with the first ransomware ever deployed, then follows the money to the present: 7,874 leak-site victims in 2025, a record; 146 active extortion groups by June 2026; and the number that explains all of it, the collapse in the price of broker-sold access to a corporate network from $1,427 in early 2023 to $439 today.That collapse is the through-line. It is a direct continuation of the speaker's Black Hat MEA 2024 session on infostealers, tracing what happens after stolen credentials are sold, and showing how oversupply from stealer logs rewrote ransomware economics.The session then examines who actually gets paid. Leaked affiliate panel data shows most affiliates never earn anything. Victim payment rates have fallen from 78.9% in 2022 to 20% at their record low. Yet attack volume keeps climbing. The talk explains that paradox, surfaces a genuine and unresolved contradiction in the industry's own payment statistics, and argues the headline figure may rest on a structurally biased sample.Three groups illustrate the model: LockBit and what survives a takedown, Scattered Spider and the human layer, and The Gentlemen, the fastest-growing operation on record. It closes with Middle East-specific data and the first documented ransomware operation run end to end by an AI agent, with no human at the keyboard.
- 14:10
- Thu
- 03 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote