IT Elements 2026 to Stage IT Apocalypse Simulations and Critique Russian Vendors
The IT Elements 2026 conference has released its detailed program, promising an intense focus on business continuity in the aftermath of cyberattacks, infrastructure collapses, or other technological disasters.
More than one hundred reports, panel discussions, live demonstrations, and master classes will take place on 9-10 September at the DK Serp i Molot venue in Moscow. The central theme, “Business Continuity 2.0,” will explore how organizations must operate after ransomware encryption, data-center failures, or similar events.
During the opening plenary, CIOs and CISOs will debate the continued relevance of the classic primary-backup data-center architecture, the effectiveness of the 3-2-1 backup rule against contemporary encryption malware, and the question of ultimate responsibility for cyber resilience.
Practical sessions will include a live demonstration of migrating away from Microsoft infrastructure in 60 minutes, moving Exchange and MinIO workloads to Russian platforms, and an unvarnished assessment of domestic hyperconverged solutions. Independent comparative tests of routers, NGFW, and virtualization systems will be presented with raw performance figures.
Additional tracks will address monitoring of corporate AI systems from GPU to prompt, taking into account FSTEC Order No. 117, OWASP Top 10 for LLM, and MITRE ATLAS. Case studies from Rosatom, Beeline, Sber, and T-Bank will be shared.
In the recovery track, Trubnaya Metallurgicheskaya Kompaniya will model a 48-hour IT outage and demonstrate how to restore full business operations within half a day. Other sessions will cover ransomware defense, crisis response, DR-plan management, and post-incident recovery.
The first day will conclude with the “Engineering Art” awards ceremony. Applications for six categories, ranging from security engineer to engineering-team leader, are open until 31 August.
Related articles
Negotiating with Ransomware Attackers: Lifeline or Legal Trap?
Ransomware incidents leave organizations facing encrypted systems and threats to leak stolen data, prompting urgent questions about whether to contact extortionists. Experts emphasize that initial response must focus on containment, evidence preservation, and backup verification rather than immediate payment discussions. NCSC guidelines stress isolating affected systems, securing communication channels, and understanding the exact nature of demands before any dialogue begins. Real-world cases such as the PowerSchool breach demonstrate that paying ransoms does not ensure data deletion or end extortion attempts. Legal risks vary by jurisdiction, with prohibitions in places like North Carolina and sanctions concerns from OFAC complicating decisions for many entities. Technical recovery options, including tools from the No More Ransom project, should be evaluated alongside insurance and regulatory notification requirements under Russian Federal Law No. 152-FZ. Ultimately, successful resolution depends on verified restoration capabilities and eliminating attacker persistence rather than any negotiated discount.
Qilin Ransomware Claims at Least 365 Victims in Three Months of Attacks
The Qilin ransomware group has claimed responsibility for at least 365 organizations compromised over a three-month period, according to research published on November 11, 2026. Operating as a ransomware-as-a-service platform since September 2022, Qilin supplies the attack infrastructure while affiliates conduct intrusions and receive at least 80 percent of ransom payments. The group employs double extortion tactics, stealing sensitive data before encryption and threatening public leaks if ransoms are not paid. Its affiliate program was described as the most active worldwide during the measured timeframe. Researchers also linked the group's administrator, known as Haise, to Aleksey Mikhailovich Yakovtsev, a 36-year-old resident of Saint Petersburg, Russia, through reused online identities spanning multiple cybercrime forums and leaked records from Gosuslugi. The investigation highlighted Qilin's technical reach, including targeted attacks against VMware vCenter and ESXi environments using remote management tools, lateral movement, and vulnerable drivers to disable security products.
Ransomware Group BYOD Claims Theft of Toyota Customer Personal Data in Unverified Extortion Listing
A ransomware group calling itself BYOD has added Toyota to its victim list on a dark web extortion site, claiming to have stolen personal information belonging to the automaker’s customers. The announcement, updated on November 10, 2026, alleges access to full names, email addresses, physical addresses, telephone numbers, and dates of birth, along with data from the company’s self-service kiosk terminals. No independent verification of the claims has been performed, and the listing provides no details on the volume of records, affected regions, or specific business units involved. The group states that parts of the environment were isolated but claims residual remote access paths remained; however, the announcement contains no technical indicators or proof-of-compromise samples. Toyota has not issued any public statement confirming or denying the incident. The report notes that similar unverified listings are sometimes used to pressure victims into negotiations and may include repackaged data from prior breaches. This marks a contrast with Toyota’s 2023 public disclosure of a separate cloud misconfiguration incident that the company itself reported.
Santos Port Authority Systems Offline After Suspected Cyber Incident and Possible Ransom Demand
The systems of Autoridade Portuária de Santos (APS), which manages Brazil's largest port, have been unavailable since the morning of November 6, 2026. The outage began after a power fluctuation that affected servers and later recurred despite initial restoration efforts. APS has confirmed a suspected cyber incident but has not determined the full scope or whether data was accessed. Local reporting indicates that alleged attackers demanded financial ransom to restore operations, though this claim remains unconfirmed by APS or federal police. Backups have been sent for forensic examination while Serpro technicians assist in recovery. Port operations continue using manual procedures and heightened security measures, but vessel and truck wait times have increased significantly.