This chapter is from the book
This chapter is from the book
This chapter is from the book
3.7 Extortion
The final phase of a cyber extortion incident is often the loudest and most aggressive. The adversary has already taken the time to infect the network, compromise assets, exfiltrate data, and/or encrypt the filesystem, and now the adversary is looking to monetize the attack.
With the need for stealth gone, the adversary begins the process of extortion. The primary extortion notification methods typically include:
Passive notification (i.e., the ransom note)
Active notification (e.g., phone calls, voicemails)
Third-party outreach (e.g., direct communications with customers, data subjects)
Publication (e.g., dark web blogs, Telegram channels, Twitter feeds)
We discuss each of these tactics in turn in the following subsections.
3.7.1 Passive Notification
The adversary typically makes it obvious to the victim that they are being extorted. This can be, and often is, as simple as a ransom note left on the desktop. However, many adversaries have leveled up, and now include multimedia such as audio versions of the ransom demand.
The ransom note commonly includes the following information:
An announcement of what happened
Instructions for how to recover files
A clear deadline (this may be a countdown timer or a simple deadline)
Contact information for the adversary (typically an email address or link to a portal)
Advice for obtaining cryptocurrency
Psychological pressure, such as threats (e.g., “Your business is at serious risk.”19) as well as reassurances (e.g., “But do not worry. You have a chance! It is easy to recover in a few steps.”20)
Figure 3.3 shows an example of a ransom note left by the Maze hacking group in 2020.21
)
Figure 3.3 A sample Maze ransom note from the LMG Security malware lab
(Illustration courtesy of LMG Security)
3.7.2 Active Notification
The adversary might actively engage in communicating with the victim throughout the extortion phase. This commonly includes sending emails, but can also involve phone calls, text messages, voicemails, Telegram messages, and other methods. Typically, the aim is to intimidate the victim and demonstrate the adversary’s level of access. In many cases, adversaries monitor the victim’s emails and may even make snide comments on current response activities.
3.7.3 Third-Party Outreach
Adversaries have been known to reach out directly to third parties affected by the compromise, including customers, patients, data subjects, and business associates, to encourage them to pressure the victim organization into paying a ransom. In some cases, they may also reach out to competitors or others in an effort to sell stolen data.
As discussed in Section 2.7, The Dark Overlord (TDO) cyber extortion group hacked the Johnston Community School District Iowa in 2017 and texted threatening messages to parents. More recently, cyber extortion gangs have taken to leveraging scalable communications methods such as email so as to connect directly with data subjects and affiliates. For example, one convenience store chain that was extorted by the Clop ransomware gang discovered that its customers had received the following email notifying them of the compromise:22
Good day!
If you received this letter, you are a customer, buyer, partner or employee of [VICTIM- REDACTED]. The company has been hacked, data has been stolen and will soon be released as the company refuses to protect its peoples’ data.
We inform you that information about you will be published on the darknet (http://
) if the company does not contact us.
Call or write to this store and ask to protect your privacy!!!!
3.7.4 Publication
Adversaries may publish extortion notification on dark web sites, Telegram channels,23 social media platforms, and more, anticipating that victims will view their posts and receive pressure from third parties. In addition, adversaries routinely leverage the mainstream media, particularly when threatening to publish data, as discussed in Section 2.8.