Ransomware Groups Weaponize Stolen Data to Increase Pressure on Targets Who Refuse to Pay:, Sophos
Sophos, a global leader of innovative security solutions for
defeating cyberattacks, released a new dark web report, “Turning the
Screws: The Pressure Tactics of Ransomware Gangs,” which details how
cybercriminals are weaponizing stolen data to increase pressure on targets who
refuse to pay. This includes sharing the contact details or doxing the family
members of targeted CEOs and business owners, as well as threatening to report
any information about illegal business activities uncovered in stolen data to
the authorities.
In
the report, Sophos X-Ops shares posts found on the dark web that show how
ransomware gangs refer to their targets as “irresponsible and negligent,” and
in some cases, encourage individual victims whose personal information was
stolen to pursue litigation against their employer.
“In
December 2023, in the wake of the MGM casino breach, Sophos began taking note
of ransomware gangs’ propensity to turn the
media into a tool they can use to not only increase pressure on
their victims but take control of the narrative and shift the blame. We are
also seeing gangs singling out the business leaders they deem ‘responsible’ for
the ransomware attack at the companies they target. In one post we found, the
attackers published a photo of a business owner with devil horns, along with
their social security number. In a different post, the attackers encouraged
employees to seek ‘compensation’ from their company, and, in other cases, the
attackers threatened to notify customers, partners and competitors about data
breaches. These efforts create a lightning rod for blame, increasing the
pressure on businesses to pay up and potentially exacerbating the reputational
damage from an attack,” said Christopher Budd, director, threat research,
Sophos.
Sophos
X-Ops also found multiple posts by ransomware attackers detailing their plans
to search for information within stolen data that could be used as leverage if
companies don’t pay. For example, in one post, the WereWolves ransomware actor
notes that any stolen data is subject to “a criminal legal assessment, a
commercial assessment and an assessment in terms of insider information for
competitors.” In another example, the ransomware group Monti noted that it
found an employee at a targeted company searching for child sexual abuse
material and threatened to go to the police with the information if the company
didn’t pay the ransom.
These
posts align with a broader trend of criminals seeking to extort companies with
increasingly sensitive data relating to employees, clients or patients,
including mental health records, the medical records of children, “information
about patients’ sexual problems” and “images of nude patients.” In one
ransomware case, the Qiulong ransomware group posted the personal data of a
CEO’s daughter, as well as a link to her Instagram profile.
“Ransomware
gangs are becoming increasingly invasive and bold about how and what they
weaponize. Compounding pressure for companies, they’re not just stealing data
and threatening to leak it, but they’re actively analyzing it for ways to
maximize damage and create new opportunities for extortion. This means that
organizations have to not only worry about corporate espionage and loss of
trade secrets or illegal activity by employees, but also about these issues in
conjunction with cyberattacks,” said Budd.
Leave A Comment