The rise of double extortion ransomware

We've become familiar with the widespread use of ransomware, but researchers at Rapid7 have been examining the rise of a newer phenomenon, 'double extortion'.

Pioneered by the Maze ransomware group, double extortion involves cybercriminals collecting files before encrypting them. Then if the target organization refuses to pay they threaten to release sensitive information.

Researchers believe the growing adoption of backups as one of the best lines of defense against ransomware file encryption has likely influenced this trend. Backups give victims the ability to restore their files without paying ransoms, however, they can't protect victims from the coercive pressure of the data disclosure layer of double extortion.

"They hit you with with ransomware and then they have a bunch of files that they've stolen," says Erick Galinkin, principal AI researcher at Rapid7. "And if you say, 'Well, we have backups, we're not going to pay you.' They say, 'We've got all this stuff and we're happy to release it to the world if you don't want to pay.' Some of these stolen files get released publicly and nearly always there's an opportunity to pay the ransom before more data gets disclosed. They do that initial data disclosure and they say, 'We're going to give you a little bit more time, now that we've proven that we have this, before we release everything that we took from you.' The intent is to pressure businesses into payment."

Rapid7 analysts investigated 161 separate data disclosures between April 2020 and February 2022. The now-defunct Maze ransomware group was the leader of the double extortion tactic in 2020, accounting for 30 percent of all 94 reported April-December 2020 incidents. This 'market share' is remarkable since Maze was active for only 10 out of 12 months that year before shutting down in early November 2020. Other top ransomware groups with data disclosures that year were REvil/Sodinokibi (19 percent), Conti (14 percent), and NetWalker (12 percent).

Financial data is the most commonly leaked (63 percent), followed by customer/patient data (48 percent). Intellectual property is rarely leaked in general (12 percent), except in pharmaceuticals, where it has been included in 43 percent of the disclosures investigated.

You can read more on the Rapid7 blog.

Image credit: Yuri_Vlasenko / depositphotos.com