Regional Conference on Ransomware Concludes with Cross-Sector Dialogue

04.12.2025

The Western Balkans Cyber Capacity Centre (WB3C) hosted the regional conference “Confronting Ransomware: Analysis and Strategy for the Western Balkans” on 2-3 December 2025. The event served as a platform for structured dialogue among key stakeholders from the region and international partners. The discussions were guided by Vanja Madzgalj, our Senior Project Manager, who served as the conference host, ensuring a cohesive and productive exchange of ideas throughout the two-day programme.

The conference was opened by Mr. Marash Dukaj, Minister of Public Administration of Montenegro who stressed the importance of continued development and collaboration, despite significant progress Montenegro has made over the past few years. The critical role of international cooperation was acknowledged by H.E. Anne-Marie Maskay, Ambassador of France to Montenegro, and H.E. Bernarda Gradišnik, Ambassador of Slovenia to Montenegro, highlighting the partnership that established the WB3C.

Over two days, sessions were designed to address the ransomware challenge from distinct professional viewpoints.

Day 1: Understanding the Threat and Response Mechanisms

Panel 1: The Operational Threat Landscape. This session provided a technical and strategic overview of ransomware from national and private sector perspectives.
- Moderator: Igor Kovač, Government Information Security Office of Slovenia (URSIV).
- Panelists: Dušan Polović (Ministry of Public Administration, Montenegro), Saimir Kapllani (National Cyber Security Authority, Albania), Predrag Puharić (Cyber Security Excellence Centre, BiH), and Mladen Bukilić (Čikom, Montenegro).
- Key Discussion: The panel detailed the current scale and methods of attacks, emphasizing the need for shared threat intelligence. They looked at how ransomware has been evolving in the recent years and how governments and private sector are preparing for to prevent and respond growing threats. Disparity in defensive resources, especially sophisticated AI capabilities, affects overall organizational esilience.
Panel 2: Law Enforcement Perspective on Cybercriminal Organizations. This panel focused on the investigative viewpoint, examining the structure and operations of ransomware groups.
- Moderator: Francisco Losada, Cybercrime Specialist, EUROPOL.
- Panelists: Julien Hamm (Anti-cybercrime Office (OFAC), France), Nenad Bogunović (High-Tech Crime Unit, Ministry of Interior, Serbia), and Sreten Ćorić (High-tech Crime Unit, Police Directorate of Montenegro).
- Key Discussion: Experts outlined the sophisticated, business-like models of cybercriminal groups. Challenges highlighted included the cross-jurisdictional nature of investigations and the constant evolution of adversarial tactics, which require continuous adaptation and closer international police collaboration.
Keynote Presentation: A Law Enforcement Blueprint. Captain Pascal Martin of the French Gendarmerie delivered a keynote address, decrypting a successful operation against a ransomware network. His presentation provided a concrete blueprint for combining digital forensics, international judicial cooperation, and public-private intelligence sharing to achieve tangible results.
Case Study: The Private Sector Response. Vladimir Mlynar, CISO for VINCI Energies CEE, presented a detailed case study from the private sector. He walked through the operational timeline of a real-world ransomware incident, offering insights into crisis management, communication challenges, and recovery strategies under pressure.
Panel 3: The Legal and Jurisdictional Framework. This discussion explored the judicial and prosecutorial challenges in combating ransomware.
- Moderator: Ana Bukilić, International Development Law Organisation (IDLO).
- Panelists: Aurélien Brouillet (Deputy Prosecutor, Judicial Court of Paris), Marina Barbir (Judge, Higher Court of Belgrade), and Ivaylo Iliev (Assistant to the National Member for Bulgaria, EUROJUST).
- Key Discussion: The conversation centered on the complexities of applying national laws to transnational cybercrime. Key challenges involve harmonizing legal standards for evidence collection, ensuring effective prosecutions, and streamlining formal international cooperation channels to keep pace with the speed of cyber incidents. The need for training in digital forensics for prosecutors and judges was emphasized as key in advancing judicial response in cases involving digital evidence and other sophisticated technologies.
Special Session: Technical and Legal Aspects of Cryptocurrency Seizure. This exchange focused on the financial dimension of ransomware response.
- Participants: Laurent Tisseyre (TRM Labs) and Dr. Arben Murtezić (Legal Counsel and Law Professor).
- Key Discussion: The dialogue between a technical analyst and a legal expert underscored the difficulty of tracing and immobilizing illicit cryptocurrency payments. Challenges include the need for specialized blockchain forensic tools and navigating varied national regulations for asset seizure and recovery.

Day 2: Evolving Tactics and Crisis Management

Panel 1: The Impact of Artificial Intelligence. This session assessed AI's dual role in both advancing threats and empowering defenses.
- Moderator: David Toulotte, Cyber reservist, Head of Global IT @ ArcelorMittal Europe.
- Panelists: Mitja Trampuž (Creaplus/ai4si, Slovenia), Ivan Bošković (IT Advanced Services, Montenegro), and Prof. Dimitar Bogatinov (Military Academy, Skopje).
- Key Discussion: Panelists explored how AI lowers barriers for executing more persuasive and adaptive attacks. A significant challenge is the rapid adoption of AI systems without corresponding security safeguards, creating new vulnerabilities even as AI offers new tools for cyber defense. Constant advancement of attacks forces defenders to also develop faster. The conclusion of the panel was that AI is here to stay, as one of the greatest inventions of man.
Panel 2: Incident Response and Negotiation Dynamics. This panel addressed the critical decision-making processes during an active ransomware attack.
Presentation: Resilience at Scale. Jérémy Couture, former Head of Cybersecurity for the Paris 2024 Olympic Games, provided a unique testimony on defending a hyper-complex, global target. His presentation on managing extreme-scale threats and stakeholder coordination offered critical lessons for national and corporate resilience planning.
- Moderator: Gilles Schwoerer, Head of WB3C.
- Panelists: Jean-Dominique Nollet (CISO, TotalEnergies) and Captain Pascal Martin (French Gendarmerie).
- Key Discussion: The session covered the operational, legal, and ethical complexities of ransom negotiations. The main challenges discussed were balancing incident containment, legal obligations, and business continuity under severe pressure, all while coordinating with law enforcement investigations.

The conference facilitated a substantive exchange of perspectives from law enforcement, the judiciary, the private sector, and policy makers. The discussions reinforced that an effective response to ransomware requires continuous, practical collaboration across these sectors and borders, with a focus on addressing shared challenges in capacity, legislation, and joint operations. The highly engaged audience, whose numerous questions created a dynamic, two-way conversation deepened the value of each session. We thank all the speakers and participants for their great contribution to this conference and our Project Manager Maja Miranovic for putting together this great event.

Check out event photos here:

https://www.jaredic.com/p467614661 (day 1)

https://www.jaredic.com/p549115929 (day 2)

Other news and events

Upcoming

Disinformation and Foreign Information Manipulation and Interference Capacity Building Workshops

Programme

📅 30 November – 1 December 2026
📍 Science and Technology Park, Podgorica, Montenegro
🏛️ Conference Hall Unicorn, 2nd floor

Context: Building on WB3C’s May 2026 regional conference, these workshops examine how governments, media and other stakeholders can anticipate, prevent and respond to malign information operations. Sessions combine strategic perspectives with practical approaches to threat detection, crisis coordination, reporting and AI-enabled information manipulation. The programme is provisional and still subject to change.
Audience: Government strategic communications officials, cybersecurity leadership, journalists, media regulators, fact-checkers and civil society organisations.
Working language: English (no simultaneous interpretation).
Chatham House Rule: The workshops will be held under the Chatham House Rule, providing a safe space for an open dialogue.

Funding: The event is organised under the EU-funded project “Improving the resilience of critical entities and the protection of public spaces and cyberspace against security threats in the Western Balkans” (2026–2028). This event is also supported by Poland, Norway, United Kingdom and France, through their diplomatic missions in Podgorica and Belgrade.

DAY 1 – Monday, 30 November 2026

☕ 08:30–09:00 | ARRIVAL
Registration and welcome coffee

🕘 09:00–09:30 | OPENING REMARKS
• WB3C
• Ministry for European Affairs of Montenegro
• EU

🎙️ 09:30–10:00 | MODERATED POLICY DIALOGUE
Montenegro at the Crossroads: Safeguarding Its Democracy and European Future in an Era of Hybrid Threats
• Biljana Papović — State Secretary, Ministry of European Affairs of Montenegro
• Todor Goranović — Defence and Security Advisor to the Prime Minister of Montenegro

Moderator: Matthew Booth, UK

🕘 10:00–10:45 | EXPERT SESSION
The Agents of Chaos: The Shadow Campaign Against the West
• Maciej Bukowski — Casimir Pulaski Foundation, Poland

☕ 10:45–11:15 | COFFEE BREAK

🕚 11:15–12:00 | EXPERT SESSION
From Detection to Decision: How VIGINUM Feeds Government Crisis Management During Hybrid Campaigns
•VIGINUM — France’s service for vigilance and protection against foreign digital interference

🕐 12:00–13:00 | MODERATED DISCUSSION
The AI Disinformation Battlefield: New Weapons, New Threats, New Defences – and the Fight for Public Trust
• Dr. Raphaël-David Lasseri — Magic LEMP, France
• Henrik Vold — Norwegian Institute of Journalism, Norway
• Eirik Veum — Norwegian Police Security Service (PST), Norway
• Dr. Daniel Schroeder — SINTEF Digital, Norway
Moderator: Dr. Ingrid Vik, Director UTSYN, Centre for Security and Resilience, Norway

🍽️ 13:00–14:00 | LUNCH

🕑 14:00–14:30 | EXPERT SESSION
Geopolitical shifts and impact on the Western Balkans
• Jamie Tarabay — Crumpton Global, USA

🕑 14:30–15:15 | EXPERT SESSION
Coordination and decision making during an ongoing hybrid assault
• Matthew Booth — FCDO, United Kingdom

🕒 15:15–16:30 | EXPERT SESSION
Modern Information Warfare: The Global Strategy to Destabilise the Western Balkans
• David Colon — Sciences Po, France

🎤 16:30–17:00 | QUESTIONS FROM THE AUDIENCE

DAY 2 – Tuesday, 1 December 2026

🛠️ 08:00–09:30 | CLOSED WORKSHOP

• David Colon — France
• Matthew Booth — United Kingdom

🕙 10:00–12:00 | ROOM 1: WORKSHOP FOR GOVERNMENT INSTITUTIONS
From Detection to Institutional Response

• David Colon — Sciences Po, France
• VIGINUM — France
• Dr. Raphaël-David Lasseri — Magic LEMP, France

Context: Government institutions may detect suspicious activity without a clear process for assessing significance and mobilising a response.

Objective: Practise moving from initial indicators and analytical findings to an institutional assessment, escalation decision and coordinated response.

🕚 10:00–12:00 | ROOM 2: WORKSHOP FOR MEDIA AND CIVIL SOCIETY
Verification of an AI-Amplified Information Operations

• Henrik Vold — Norwegian Institute of Journalism, Norway
• Eirik Veum — Norwegian Police Security Service (PST), Norway
• Dr. Daniel Schroeder — SINTEF Digital, Norway

Context: Synthetic content, coordinated amplification and misleading claims complicate verification under time pressure.

Objective: Apply verification and source-assessment methods to a simulated information operation, distinguishing evidence, uncertainty and responsible reporting.

☕ 12:00–13:00 | LUNCH

🧩 13:00–14:30 | WORKSHOP FOR GOVERNMENT INSTITUTIONS
Crisis decisions under pressure
• Maciej Bukowski — Casimir Pulaski Foundation, Poland
Practical tabletop exercise.

🧩 13:00–14:30 | WORKSHOP FOR MEDIA AND CIVIL SOCIETY
Editorial judgement during a hybrid crises (TBC)
• Jamie Tarabay — Crumptom Global, USA
Practical tabletop exercise.

🍽️ 14:30–15:00 | COFFEE BREAK

🛠️ 15:00–16:30 | PLENARY WORKSHOP
Government-Media Crisis Coordination Simulation

• Matthew Booth — FCDO, UK

DAY 3 – Wednesday, 2 December 2026

🛠️ Time TBC | UNIVERSITY GUEST LECTURES

• Maciej Bukowski — Casimir Pulaski Foundation, Poland
• Jamie Tarabay — Crumpton Global LLC
University of Donja Gorica, Faculty of Humanities

NB. To register for the conference please use this LINK or contact vanja.madzgalj@wb3c.org. The number of seats is limited.

This event will be photographed. Please read our Privacy Policy on the Registration Form.

To download the programme and the speakers bios, go to the top of the page.

From Open Sources to Investigative Intelligence: Advanced OSINT

Open-source intelligence is increasingly central to modern cyber investigations. But finding information is only part of the challenge. Knowing how to investigate securely, connect findings and turn fragmented data into actionable intelligence is what makes the difference.

On 10–11 November, WB3C is hosting a two-day advanced OSINT training in Podgorica, bringing together specialists from cybercrime units and judicial investigative services across the Western Balkans.

Delivered by Nicolas De Rycke and Jean-Pier Bonnet JP BNT, the practical training introduces participants to elephantastici io, an advanced investigative platform, with a focus on:
✅ Operational security during online investigations
✅ Advanced search capabilities and intelligence gathering
✅ Exporting findings for investigative reports and case files
✅ Building logical investigation maps to connect evidence and trace research activities
The training also brings together professionals who have completed WB3C's recent Train-the-Trainers programme, providing an opportunity to deepen their technical expertise and explore tools that can support their investigative work.
The focus is on practical application: giving investigators the tools and techniques to work more effectively, securely and systematically in an increasingly complex digital environment.

Selection underway for the next generation of cybersecurity diploma programme

The Western Balkans Cyber Capacity Centre (WB3C), in partnership with the Université de Technologie de Troyes (UTT), France, is preparing to welcome the next generation of participants to its one-year Cybersecurity Diploma Programme, starting in February 2027.
The selection process is already underway, reflecting strong regional interest in advanced cybersecurity education:
🧑‍🎓 23 candidates from across the Western Balkans applied.
🧑‍🎓 17 candidates successfully passed the first pre-selection examination.
🧑‍🎓 13 November marks the next stage, with candidates taking a second entrance examination.

The programme places hands-on training and practical experience at the heart of its curriculum with a view of equipping participants with the technical skills and operational competencies needed to address real-world cyber threats, making them job-ready for the most in-demand entry level jobs.

Through its partnership with UTT, WB3C is helping bridge the gap between academic knowledge and operational readiness, developing a new generation of skilled cybersecurity professionals capable of strengthening cyber resilience across the Western Balkans.