Session Abstract: Follow in the footsteps of a cybercriminal and uncover their digital footprint. This is a journey inside the mind of an ethical hacker's response to a ransomware incident that brought a business to a full stop, followed by the discovery of evidence to uncover their attack path and techniques used. In this session, we will cover a real-world incident response to the CryLock ransomware: the techniques used to launch an attack and what we uncovered from digital footprints left at the scene.