What does it mean when ransomware actors use “double extortion” tactics?
Summary: Double extortion ransomware actors encrypt a target's files and leave a ransom note for a decryption key, then add a second threat to leak stolen data publicly and on the dark web if the ransom is not paid. Cisco Talos cites RA Group, a newly discovered actor, which gives victims three days to pay, posts victim names and stolen file sizes on its leak site, promises to release all documents within one year, and threatens to sell the data to other actors via the qTox encrypted messaging platform.
Bottom line: RA Group's leak site is one of the first Talos has seen that publicly threatens to sell stolen data during that one-year window, turning a single breach into a standing market for PII and financial information that other actors can use in follow-on attacks or identity theft.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·