IT Elements 2026 to Stage IT Apocalypse Simulations and Critique Russian Vendors
The IT Elements 2026 conference has released its detailed program, promising an intense focus on business continuity in the aftermath of cyberattacks, infrastructure collapses, or other technological disasters.
More than one hundred reports, panel discussions, live demonstrations, and master classes will take place on 9-10 September at the DK Serp i Molot venue in Moscow. The central theme, “Business Continuity 2.0,” will explore how organizations must operate after ransomware encryption, data-center failures, or similar events.
During the opening plenary, CIOs and CISOs will debate the continued relevance of the classic primary-backup data-center architecture, the effectiveness of the 3-2-1 backup rule against contemporary encryption malware, and the question of ultimate responsibility for cyber resilience.
Practical sessions will include a live demonstration of migrating away from Microsoft infrastructure in 60 minutes, moving Exchange and MinIO workloads to Russian platforms, and an unvarnished assessment of domestic hyperconverged solutions. Independent comparative tests of routers, NGFW, and virtualization systems will be presented with raw performance figures.
Additional tracks will address monitoring of corporate AI systems from GPU to prompt, taking into account FSTEC Order No. 117, OWASP Top 10 for LLM, and MITRE ATLAS. Case studies from Rosatom, Beeline, Sber, and T-Bank will be shared.
In the recovery track, Trubnaya Metallurgicheskaya Kompaniya will model a 48-hour IT outage and demonstrate how to restore full business operations within half a day. Other sessions will cover ransomware defense, crisis response, DR-plan management, and post-incident recovery.
The first day will conclude with the “Engineering Art” awards ceremony. Applications for six categories, ranging from security engineer to engineering-team leader, are open until 31 August.
Related articles
LockBit Claims Breach of U.S. Bank, Sets September 2026 Deadline for Ransom Payment
The ransomware group LockBit has added U.S. Bank to its leak site, claiming to have stolen data from the financial institution and threatening to publish it unless a ransom is paid by September 3, 2026. U.S. Bank stated it is actively investigating the claims but has so far found no evidence of unauthorized network access or impact on internal systems. Lee Henderson, the bank's vice president of public affairs, confirmed that the institution is monitoring the situation and treating the allegations seriously. LockBit placed the bank's domain on its extortion portal on August 19 and has a history of resuming operations after a major international law enforcement disruption in 2024. The investigation remains ongoing, with the final scope depending on whether unauthorized access and data theft can be confirmed.
Sorry Ransomware Exploits cPanel Vulnerability to Directly Lock Linux Servers in Multiple Chinese Incidents
China's National Computer Virus Emergency Response Center has issued a warning about the Sorry ransomware, which targets exposed Linux web servers through a cPanel authorization vulnerability. The Go-based malware gains root access without any phishing or user interaction, disguises itself as the legitimate sshd process, and follows a six-stage attack chain that includes data exfiltration before encryption. It terminates databases, security tools, and backup services, then uses AES and RSA to encrypt files with a .sorry extension while demanding ransom via an encrypted communication tool. The campaign specifically affects small and medium-sized enterprises running cPanel on mainstream Linux distributions, including domestic Xinchuang systems. Attackers also scan internal networks for weak SSH credentials to spread laterally. The center urges immediate patching of cPanel, exposure reduction, strong passwords, offline backups, and avoidance of fake decryptors.
China Warns of New 'Sorry' Ransomware Targeting Exposed Linux Web Servers via cPanel Vulnerability CVE-2026-41940
China's National Computer Virus Emergency Response Center has issued an official alert after multiple incidents of the newly discovered 'Sorry' ransomware family struck Linux Web servers inside the country. The Go-language malware specifically targets internet-exposed servers running vulnerable versions of WebPros cPanel and can also run on domestic Xinchuang operating systems. Attackers exploit authorization flaw CVE-2026-41940 (CNNVD-202604-5641) to gain access, deploy the ransomware disguised as sshd processes, kill backup and security services, exfiltrate data, and encrypt files with AES and RSA before scanning for weak SSH credentials to spread laterally. The advisory states that no reliable decryption method currently exists once files receive the .sorry extension. Organizations are urged to immediately audit cPanel versions, inspect processes, restrict management interfaces, eliminate weak passwords on ports 22/2222/22222, and verify offline backups.
Ransomware Groups Disable EDR, Backups and Windows Telemetry Before Encryption
Ransomware operators are increasingly focusing on disabling endpoint detection and response tools, backup systems, and Windows telemetry mechanisms prior to launching encryption. An analysis of the ten ransomware families with the lowest prevention rates in 2026 found that Play achieved only 13 percent of attacks blocked. BlackByte followed with 25 percent blocked and LockBit with 30 percent blocked. BabLock leverages a legitimate uninstaller to remove endpoint protection and terminates processes belonging to antivirus, EDR, backup, and database applications. It then clears the Security and System event logs to hinder incident response. LockBit 5.0 instead interferes with Event Tracing for Windows to reduce visibility for monitoring solutions. Additional families employ process injection, in-memory execution, registry modifications, file masquerading, and living-off-the-land binaries to evade detection.