• Cybercrime is a profit-driven business, from scam compounds to crypto heists.
• Criminal networks are fracturing, and AI agents are the next threat.
• Collaboration across borders and sectors is the best defense.

Cybercrime is no longer a story about lone hackers. It's a global business with supply chains, customer service, and, increasingly, AI agents doing the work. At RSAC™ 2026, practitioners, researchers, and law enforcement leaders took the stage to show attendees how that business runs and where it breaks.

The good news is that many of those conversations live on. We've gathered nine of the standout cybercrime sessions into the Cybercrime playlist on the RSAC Membership platform. Whether you missed them in San Francisco or want a refresher, here's what you'll find, and why it matters as we look ahead to RSACTM Cyber Fraud Day at RSA Conference™ 2027.

Follow the Money

Every cybercrime operation runs on incentives, and three sessions traced those incentives back to their source.

In Pig Butchering's Expansion: Billions Lost, Sextortion Added, Action Needed, Erin West, Founder, Operation Shamrock, shared new evidence that Southeast Asian scam compounds have moved well beyond investment fraud. They now run sextortion and trafficking operations that fuel a multi-billion-dollar criminal empire. Her call to action was clear: security, finance, and law enforcement teams have to fight back together.

Go deeper: For the backstory, watch West's RSAC 2025 Conference session, Pig Butchering and the Threat of Transnational Organized Crime, which frames these scams as an underdiscussed national security threat.

Cryptocurrency remains a favorite target. In Web3: Old Foes, New Chains, 5 Lessons Learned from Crypto Heists, Sylvain Hirsch, Mandiant Security Strategy Manager, Google Cloud, drew on frontline incident response to show how North Korean threat actors exploit both Web2 and Web3 weaknesses. With Web3 organizations losing $3.1B in the first half of 2025 alone, his lessons on protecting treasury funds and digital assets are timely.

Then John Kindervag, Chief Evangelist, Illumio, asked a provocative question: Did Cyber Insurance Create Ransomware? Drawing a parallel to Victorian life insurance, which briefly encouraged murder, he argued that payouts helped fuel ransomware's growth. His answer? Zero Trust and segmentation can realign incentives, reduce payouts, and disrupt the ransomware economy.

Inside the Criminal Ecosystem

To disrupt adversaries, defenders first have to understand how they think, talk, and organize.

Jon DiMaggio, Co-Founder & Cyber Threat Researcher, Arkem Cyber, and Alexander Leslie, Senior Advisor, Government Affairs, Recorded Future, argued that Screenshots Don't Talk. Criminals Do. Their session showed how human intelligence tradecraft turns dark web monitoring into actionable intelligence. Real conversations with ransomware affiliates, scam gangs, and malware operators can reveal planned operations, validate claims, and enable takedowns.

Those same criminal relationships are showing cracks. In Gang Wars: Breaking Trust Among Cybercriminals (a session that made the final list on more than one Program Committee) John Fokker, Head of Threat Intelligence and Counter Adversary Strategy, Trellix, explored how Ransomware-as-a-Service is fracturing under law enforcement pressure. Infiltration, betrayal, and public fallout, like the notchy/RansomHub saga, are eroding trust among criminals, and defenders can use that fragmentation to their advantage.

Meanwhile, the next generation of threats is already taking shape. Stephen Hilt, Senior Threat Researcher, and Robert McArdle, Director FTR, CyberCrime Research, both of TrendAI, introduced attendees to VibeCrime: Preparing for Next Generation Agentic AI Cybercrime. Their research shows how agentic AI could evolve into autonomous cybercrime enterprises, pushing organizations to prepare for a world beyond Cybercrime-as-a-Service.

Hitting Back, Together

If one theme ran through every session, it was that no single organization can take on cybercrime alone.

Disrupting Cybercrime Networks, Successfully, Continuously, and at Scale brought together Derek Manky, Chief Security Strategist & VP Global Threat Intelligence, Fortinet; Akshay Joshi, Head, Centre for Cybersecurity, World Economic Forum; Neal Jetton, Director, Cybercrime Directorate, INTERPOL; Alexandra Gerst, Senior Corporate Counsel, Digital Crimes Unit, Microsoft; and Jethro Cornelissen, Investigations Lead, Cybercrime Atlas. Past efforts like the Conficker Working Group proved the power of joint action, but they were ad hoc. The panel shared how the World Economic Forum's Cybercrime Atlas offers a framework for sustained, cross-border disruption, and how attendees can build that kind of community in their own regions.

Governments are making the same case. In Paying the Price: Global Law Enforcement Efforts Against Cybercrime, Bryan Vorndran, Deputy CISO, Microsoft Corp.; Paul Foster, Head of the National Cyber Crime Unit, National Crime Agency; Stan Duijf, Director High Tech Crime & Cybercrime, Dutch National Police; and Carsten Meywirth, Head, Cybercrime Division, BKA, walked through recent operational successes. Information sharing and joint, sequenced operations are making it more expensive for adversaries to do business.

The stakes are highest where resources are thinnest. In Cybersecurity at the Bedside: Lessons from Safety Net Hospitals, Joseph Izzo, Chief Medical Information Officer, San Joaquin General Hospital, reminded attendees that in community hospitals, a cyberattack isn't an IT event. It's a patient safety crisis. He shared pragmatic strategies for securing facilities that can't afford disruption.

Looking Ahead: RSAC Cyber Fraud Day

These sessions made one thing clear: fraud and cybercrime deserve a dedicated stage. That's why we're excited to bring RSAC Cyber Fraud Day to RSA Conference 2027, on Wednesday April 7, 2027 in San Francisco.

Converged threats demand converged defenses. On Wednesday, April 7, join us at RSAC 2027 for the inaugural Cyber Fraud Day, where fraud, cybersecurity, identity, and risk practitioners come together to share how they detect, prevent, and disrupt scams and financial crime.

Building on the conversations started in 2026, from scam compounds and crypto theft to AI-powered crime and the partnerships that disrupt it, RSAC Cyber Fraud Day is included with the Core and Premium passes. Early bird pricing runs through December 18, 2026, so now is a great time to register.

Keep the Conversation Going

Cybercriminals collaborate, share tools, and learn from each other. Defenders have to do the same, and that's exactly what the RSACTM Community is built for. Watch the full Cybercrime playlist, share the sessions with your team, and join us at RSAC Cyber Fraud Day in April to keep hitting back, together.