Cyber extortion is a crime involving an attack or threat of an attack coupled with a demand for money or some other response in return for stopping or remediating the attack.
Cyber extortion attacks are about gaining access to an organization's systems and identifying points of weakness or targets of value. The two most common variants of cyber extortion are ransomware and distributed denial of service (DDoS) attacks.
During a ransomware attack, cybercriminals demand payment through malicious activity. They might also use a DDoS attack to steal sensitive corporate information and threaten to make it public.
Cyber extortion occurs when the attacker gains access to sensitive data on a victim's computer network or system through methods such as ad scams, phishing emails, infected websites and other techniques. The attacker might not be directly responsible for executing the attack. They have the option to use ransomware as a service or cybercrime as a service, where they hire skilled cyber attackers to perform the task on their behalf.
In a ransomware attack, a blackmailer encrypts the victim's files and offers to decrypt them only after payment is made, usually in the form of cryptocurrencies such as Bitcoin. In a DDoS attack, the cybercriminal typically threatens to carry out an attack if payment isn't made. The threat is suspended once the victim pays the attacker, but if the ransom isn't paid, a DDoS attack is conducted.
Ransomware attacks can be automated through malware distributed in emails, infected websites or ad networks. These attacks tend to spread indiscriminately, creating networks of infected computers. However, they can result in only a small percentage of victims paying the cyber extortionists. More targeted attacks can produce less collateral damage but provide more lucrative targets for the extortion attempt.
While cyber extortion and ransomware are related concepts, they aren't the same.
Cyber extortion is a broader term that refers to the different techniques cybercriminals use to force victims to comply with their demands. It entails threatening or blackmailing individuals, businesses or organizations to obtain money or other valuable assets.
Ransomware is a specific type of cyber extortion that uses malicious software to encrypt a victim's files or lock them out of their systems. After encrypting the victim's files, the attacker demands a ransom in return for releasing the decryption key or regaining access to the infected systems. During a ransomware attack, the victim is frequently given instructions on how to pay the ransom and restore access to their data.
Today, businesses are being hit by different types of cyber extortion and cyberthreats:
The Financial Crimes Enforcement Network (FinCEN), a bureau of the U.S. Department of the Treasury dedicated to safeguarding financial systems, issued an advisory in October 2020 with the following list of five types of more sophisticated cyber extortion techniques:
Companies victimized by cyber extortion schemes suffer the effects of data breaches and loss of sensitive information. These can include damage to their reputation, lost customers and lost revenue. For example, if customers can't access their preferred websites, they'll likely move on to other companies that offer the same or similar products or services. In addition, hackers will use the threat of making a victim's trade secrets or intellectual property public or selling it to rival companies. That tactic is great motivation for a victim company to pay the ransom.
Cyber extortion attacks continue to prove a threat to businesses of all sizes across the world. Some effects of recent cyber extortion events include the following:
Ransomware payments have nearly doubled to $1.5 million in 2023 compared to last year, according to Sophos, a British cybersecurity company. The report also reveals that the firms with stronger financial positions are more inclined to pay the ransom.
In recent attacks, LockBit ransomware caused serious problems for several well-known companies. Among the affected entities is a prominent dental insurance provider that exposed the sensitive information of approximately nine million patients throughout the U.S. Additionally, a water utility in Portugal and the esteemed Royal Mail of the U.K. encountered substantial service disruptions as a result of LockBit attacks.
Customers whose data is made public as the result of a cyber extortion exploit or other type of data breach might be able to recover damages from the company. Under the Graham-Leach-Bliley Act and Health Insurance Portability and Accountability Act, financial and healthcare companies can be held liable for such disclosures, incurring hefty government fines.
Cyber extortionists might also have access to a victim's private information, such as personal photos or videos. Threat actors can demand payment to stop them from sharing that information with contacts in the victim's email or on social media accounts.
Cyber extortionists are constantly searching for new vulnerabilities to exploit and new ways to threaten victims. Consequently, companies must be vigilant in their efforts to combat these exploits.
To reduce the risk of becoming a victim of cybercrime, organizations must enforce strong cyber defenses. Some best practices to reduce the risk of cyber extortion include the following:
FinCEN has identified multiple red flag indicators of ransomware related to illicit activity in the financial industry. The organization alerts financial institutions to situations that can help them detect suspicious transactions and prevent incidents.
In addition to the 2017 cyber extortion attacks against Netflix and HBO, there are other notable cases.
In 2014, Domino's Pizza was targeted by Rex Mundi, a hacker group that claimed it had stolen the records of 650,000 Domino's Pizza customers in Europe. Rex Mundi said it would release the records if Domino's didn't pay a 30,000 euro (roughly $30,000 USD) ransom. Domino's refused to pay. The company notified its customers of the breach and suggested they change their passwords. Rex Mundi never followed through on its threat.
RSS feed service provider Feedly was hit with a DDoS attack to prevent users from accessing the service. The attackers demanded money, which the company refused to pay. The company worked with authorities to bring the hackers to justice. Feedly's content network provider restored service in a couple of hours.
In 2015, a hacktivist group calling itself The Impact Team attacked Ashley Madison, a hookup site for people who are married or in relationships. The attackers said they compromised the company's database, which held the personally identifiable information of 37 million users. Rather than asking for money, the group threatened to release the information if the company's owners, Avid Life Media (ALM), didn't take down two of its dating websites as punishment for defrauding its customers. The hackers claimed ALM didn't remove the personal information of some customers even though they had paid extra to have that information expunged. When ALM didn't give in to The Impact Team's demands, the group leaked Ashley Madison's customer data.
In 2017, the WannaCry attack encrypted more than 250,000 systems using asymmetric encryption. The U.K.'s National Health Service was among the targets and had to take its systems offline. The threat actors demanded payment in Bitcoin. It's unclear how many victims paid the ransom.
In 2019, threat actors attacked numerous state and local governments using Ryuk ransomware. According to the Center for Internet Security, ransoms ranged from $100,000 to $500,000 worth of Bitcoin.
In December 2020 and again in January 2021, hackers accessed dozens of organizations' data by exploiting zero-day vulnerabilities of Palo Alto-based Accellion's file transfer application. Victims included supermarket chain Kroger, blue chip law firm Jones Day, Reserve Bank of New Zealand and Shell Oil. The methods used included Structured Query Language injection and server-side request forgery. The attackers sent emails to victims threatening to make their data publicly available.
Cybersecurity firm FireEye -- now Symphony Technology Group -- revealed in December 2020 that hackers had made off with its Red Team tools, which could be used to launch sophisticated cyber attacks. U.S. officials believed that Russian intelligence agencies were behind the attack.
The SolarWinds attack was also disclosed in December 2020, revealing that the company's monitoring software had been compromised in the latter half of 2019 and was used to infiltrate and extort government agencies and private sector companies.
The ransomware attack in 2021 on Colonial Pipeline caused an eight-day shutdown of the 5,500-mile pipeline, which resulted in gas lines and shortages in New York and the Southeast. The Federal Bureau of Investigation (FBI) identified the attacker as DarkSide, a ransomware-as-a-service group known to use double extortion tactics. Colonial Pipeline is reported to have paid nearly $5 million in Bitcoin.
Since its discovery in 2022, Royal ransomware has been used in high-profile assaults against critical infrastructure, particularly hospitals. With the special partial encryption method used by this ransomware, the threat actor can select the precise portion of a file's data to encrypt, which reduces the encryption percentage for bigger files and aids in avoiding detection. In addition to encrypting material, Royal actors use double extortion strategies. Notable victims of Dev-0569, the group associated with the Royal ransomware, include Silverstone Circuit, the renowned racing circuit in the U.K.; Travis Central Appraisal District; a Texas government entity; and a major U.S. telecom provider that received a $60 million ransom demand.
The largest port in Japan, the Port of Nagoya, was the target of a ransomware attack in 2023 by the LockBit ransomware gang, which led to the port's closure. According to Japanese media, the cybercrime division of the Japanese police assisted at least three domestic companies in resuming operations following the hack. The port has since resumed operations after the ransom was paid to the attackers.
The obvious benefit to paying a ransom is regaining access to crucial files and systems. While the ransom is expensive, the cost to rebuild files or systems can be exponentially more money and time-consuming.
The FBI discourages ransom payments to criminals. The intelligence agency contends that doing so will embolden attackers to target other organizations, encourage other criminals and fund criminal activities. Paying the ransom also doesn't guarantee recovery of a victim's files. Instead the FBI urges victims to report ransomware threats to local FBI offices or the FBl's Internet Crime Complaint Center.
In October 2020, the U.S. Treasury's Office of Foreign Assets Control warned that organizations helping victims make ransomware payments could be in violation of the agency's regulations. It identified companies such as financial institutions, cybersecurity insurance firms, and those involved in computer forensics and incident response as possible offenders depending on the tactics they use.
The Cybersecurity and Infrastructure Security Agency has said an active cybersecurity insurance market could help reduce the number of successful cyber extortion incidents. Insurers would encourage customers to exercise preventative measures and best practices by basing coverage and premiums on the insured's level of self-protection.
Increasingly, customers are requiring vendors to have cyber insurance policies as part of their compliance contracts. Insurer Woodruff Sawyer said the number of its public company clients buying cyber coverage increased from 22% in 2016 to 39% in 2019, and the number continues to grow.
However, before deciding on cyber liability insurance, an organization should evaluate its risks and consult an insurance expert. In general, due to the rise in cyber attacks and data breaches, having cyber liability insurance can be beneficial, especially for technology-dependent businesses.
Cybercrime and ransomware affect every sector of the economy. Browse this expert guide for insights on effective prevention, detection and recovery strategies that apply to any industry.
18 Jul 2023