Ransomware gangs pretend to delete stolen data to extort victims twice, report warns
Security experts warn that paying ransomware hackers will likely lead to more demands
Ransomware gangs are reportedly sending victims fake evidence that stolen data has been deleted, only to use that data again in a second extortion attempt.
Notorious hacking groups such as Sodinokibi, Maze, and Netwalker have been tricking victims into a false sense of security, according to a Q3 Ransomware report from cyber security firm Coveware.
The report found that it has now become the default position for groups to hold onto data they have acquired, regardless of whether a ransomware payment has been paid by the victim. In fact, the cyber security firm found evidence that many groups are providing faked files that claim to prove that the data has been deleted.
Although some victims may decide there are valid reasons to pay, cyber security experts frequently advise against it. This is largely because there is no credible way to prove data has been deleted, or a way to ensure data has been returned, if that was the arrangement. There's also the potential that stolen data has already been traded, sold, or held by other threat actors for reuse.
Conti (aka Ryuk), which was recently revealed to be behind a third of all ransomware attacks in 2020 and is mentioned in the report, was recently blamed for an attack on French IT service Sopra Steria at the end of October. Although the company agreed to pay the ransom demanded by the hackers, it's now believed that the evidence provided to show deletion was in fact fabricated, according to Coveware.
How to improve cyber security for remote working
13 recommendations for security from any locationDownload now
"Unlike negotiating for a decryption key, negotiating for the suppression of stolen data has no finite end," the report stated. "Once a victim receives a decryption key, it can't be taken away and does not degrade with time. With stolen data, a threat actor can return for a second payment at any point in the future. The track records are too short and evidence that defaults are selectively occurring is already collecting."
In This Article
- 1The truth about ransomware
- 2What is ransomware?
- 3What are the different types of ransomware?
- 4The most popular ransomware strains targeting UK businesses
- 5Best ransomware removal tools
- 6How to keep your files safe from ransomware
- 7How can organisations protect themselves from NAS ransomware attacks?
- 8Ransomware gangs pretend to delete stolen data to extort victims twice, report warns - currently reading
- 9Maze ransomware gang retires from cyber crime
- 10Ryuk behind a third of all ransomware attacks in 2020
B2B under quarantine
Key B2C e-commerce features B2B need to adopt to surviveDownload now
The top three IT pains of the new reality and how to solve them
Driving more resiliency with unified operations and service managementDownload now
The five essentials from your endpoint security partner
Empower your MSP business to operate efficientlyDownload now
How fashion retailers are redesigning their digital future
Fashion retail guideDownload now