 This year’s evaluation saw vendors detect and respond to tactics, techniques, and procedures (TTPs) from two emulated adversary scenarios that are broadly defining modern ransomware today — Wizard Spider, a cybercriminal extortion gang, and Sandworm, a disruptive threat group focused on data destruction.