Naming and shaming: How ransomware groups tighten the screws on victims
Summary: Ransomware campaigns have shifted from encryption alone to double extortion, with dedicated leak sites first appearing in late 2019 now serving as the backbone of the strategy: attackers steal corporate data before encrypting it and publish samples on Tor-hosted sites to pressure victims into paying. The FBI and CISA now routinely describe ransomware as a "data theft and extortion" problem, and ESET notes that leak sites reflect only what criminals choose to advertise, not the full universe of incidents.
Key Takeaway: ESET reports that many organizations that paid up were hit again within months, and that stolen data reappears in phishing kits, business email compromise campaigns and identity fraud - so the payment buys neither recovery nor silence, while every payment funds the next attack.
Read the original at ESET WeLiveSecurity ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026