Cyber Extortion.

What is cyber extortion?

Cyber extortion means forcing someone to pay by threatening them through digital means. In ransomware cases, the NCSC says ransomware is a type of malware that prevents you from accessing your computer or the data stored on it. The NCSC also says attackers will threaten to publish data if payment is not made.

How does it work?

CISA’s #StopRansomware guide describes how the tactics have changed. Attackers exfiltrated victim data, meaning they copied it out of the victim’s network, and pressured victims to pay by threatening to release the stolen data. CISA says the use of both tactics is known as double extortion.

CISA also says that malicious actors may exfiltrate data and threaten to release it as their sole form of extortion without employing ransomware. So extortion does not always involve locked files.

Why does it matter?

Extortion puts pressure on a victim in more than one way. Locked systems stop work, and the threat of published data adds a second worry that backups alone do not remove. Because CISA says data theft can be used without ransomware, an organization with good backups can still face a demand. For that reason, it helps to think about stopping data from leaving the network as well as recovering from encryption.

How can you reduce the risk and respond?

CISA’s guide recommends several steps.

• Maintain offline, encrypted backups of critical data, and regularly test them.
• Implement phishing-resistant multi-factor authentication for all services, particularly email, VPNs and accounts that access critical systems.
• Regularly patch and update software and operating systems.
• If an incident happens, determine which systems were affected and immediately isolate them.
• Report the incident to CISA, your local FBI field office or the FBI Internet Crime Complaint Center.

The NCSC says law enforcement discourages paying, because there is no guarantee that you will get access to your data or computer and you will be paying criminal groups. It also says up-to-date backups are the most effective way of recovering from a ransomware attack.

Is cyber extortion the same as ransomware?

No. Ransomware is malware that blocks access to data or systems. Extortion is the pressure applied to get paid. Ransomware is one way to apply that pressure, and CISA says data theft threats can be used alone.

Is extortion the same as double extortion?

No. Double extortion is one pattern, in which data is both encrypted and stolen, and the victim is pressured on both counts.

Sources

• CISA: Double extortion; data exfiltration and release threats as sole extortion without ransomware; backups, MFA, patching, isolate, report.
• UK NCSC: Ransomware definition; attackers threaten to publish data; payment discouraged; backups most effective for recovery.