Ransomware gangs pretend to delete stolen data to extort victims twice, report warns

Security experts warn that paying ransomware hackers will likely lead to more demands

Lines of code used to create a digital skull

Ransomware gangs are reportedly sending victims fake evidence that stolen data has been deleted, only to use that data again in a second extortion attempt.

Notorious hacking groups such as Sodinokibi, Maze, and Netwalker have been tricking victims into a false sense of security, according to a Q3 Ransomware report from cyber security firm Coveware.

The report found that it has now become the default position for groups to hold onto data they have acquired, regardless of whether a ransomware payment has been paid by the victim. In fact, the cyber security firm found evidence that many groups are providing faked files that claim to prove that the data has been deleted.

Although some victims may decide there are valid reasons to pay, cyber security experts frequently advise against it. This is largely because there is no credible way to prove data has been deleted, or a way to ensure data has been returned, if that was the arrangement. There's also the potential that stolen data has already been traded, sold, or held by other threat actors for reuse.

Conti (aka Ryuk), which was recently revealed to be behind a third of all ransomware attacks in 2020 and is mentioned in the report, was recently blamed for an attack on French IT service Sopra Steria at the end of October. Although the company agreed to pay the ransom demanded by the hackers, it's now believed that the evidence provided to show deletion was in fact fabricated, according to Coveware.

Related Resource

How to improve cyber security for remote working

13 recommendations for security from any location

How to improve cyber security for remote working - whitepaper from MimecastDownload now

"Unlike negotiating for a decryption key, negotiating for the suppression of stolen data has no finite end," the report stated. "Once a victim receives a decryption key, it can't be taken away and does not degrade with time. With stolen data, a threat actor can return for a second payment at any point in the future. The track records are too short and evidence that defaults are selectively occurring is already collecting."

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Recommended

Ransomware criminals look to other hackers to provide them with network access
ransomware

Ransomware criminals look to other hackers to provide them with network access

17 Jun 2021
Four in five ransomware victims suffer repeat attacks
ransomware

Four in five ransomware victims suffer repeat attacks

16 Jun 2021
FBI still frowns on ransomware payments
ransomware

FBI still frowns on ransomware payments

11 Jun 2021
New ransomware targets unpatched Microsoft Exchange servers
ransomware

New ransomware targets unpatched Microsoft Exchange servers

1 Jun 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
What is HTTP error 400 and how do you fix it?
Network & Internet

What is HTTP error 400 and how do you fix it?

16 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021