Double Extortion.

What is double extortion?

Double extortion is a ransomware tactic with two threats at once. The attackers lock the victim’s files, and they also steal a copy of the data and threaten to release it. The victim is pressured to pay for two things: getting the files back and keeping the stolen data private.

CISA, the US cyber defense agency, describes it in its #StopRansomware Guide. It says ransomware is malware designed to encrypt files on a device, so that the files and the systems that rely on them become unusable. It then says that over time, malicious actors have also exfiltrated victim data and pressured victims to pay by threatening to release the stolen data. CISA says the use of both tactics is known as “double extortion”. To exfiltrate data means to copy it out of the victim’s network.

How does double extortion work?

There are two parts. One part is the encryption of systems, with a demand for ransom in exchange for decryption. The other part is data theft, followed by a threat to publish what was taken.

CISA’s advisory on Interlock ransomware gives a clear description. It says the actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom, both to get their data decrypted and to prevent it from being leaked. The same advisory says the actors threaten to publish the stolen data on their leak site on the Tor network unless the victim pays. A leak site is a website where attackers post or threaten to post stolen data.

CISA’s advisory on Akira ransomware uses the term in the same way. It says the Akira actors use a double-extortion model in which they both encrypt systems and threaten to leak sensitive information.

Why is it harder than plain ransomware?

As a simple illustration, imagine a company that can restore its systems from backups. With encryption alone, the problem may be mostly solved. With double extortion, the attackers still hold a copy of the data, so the threat to publish it remains.

CISA also notes that malicious actors may exfiltrate data and threaten to release it as their only form of extortion, without using ransomware at all.

How can you reduce the risk?

CISA’s guide and advisories point to these measures.

• Maintain offline, encrypted backups of critical data, and regularly test that they work.
• Use phishing-resistant multi-factor authentication for services, especially email, VPNs and accounts that reach critical systems.
• Regularly patch and update software and operating systems.
• Segment networks to limit the spread of ransomware.
• Report an incident to CISA, a local FBI field office, the FBI Internet Crime Complaint Center or a local US Secret Service field office.

How does it relate to nearby terms?

Double extortion builds on ransomware. It involves data exfiltration, which is the copying of data out of a network. A data leak site is the related term for where stolen data is threatened or posted.

Is double extortion the same as ransomware?

No. Ransomware is the wider term for malware that encrypts files. Double extortion is one way ransomware actors apply pressure, by adding data theft and a threat to release the data.

Is data theft without encryption also double extortion?

Not by CISA’s definition, which needs both tactics together. CISA describes data theft with a threat to release it, without ransomware, as a separate case.

Brandefense offers ransomware intelligence that monitors this area.