Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:00 PM
Connect Directly
E-Mail vvv

Ransomware? Let's Call It What It Really Is: Extortionware

Just as the targets of these attacks have shifted from individuals to corporations, so too has the narrow focus given way to applying force and pressure to pay.

No one needs reminding that ransomware has reached incredible proportions; one widely reported statistic from Cybersecurity Ventures suggests that ransomware costs would be $20 billion in 2020. That's almost double its $11.5 billion estimate from 2019, with a commensurately huge increase in the number of attacks, while Bitdefender suggested a 715% increase in the first half of the year.

The "crews" have multiplied, adopted tactics that are reminiscent of nation-state attacks, and developed partnerships and relationships with a speed and efficiency that put many of our business practices to shame. New tactics are constantly appearing both to gain access and to apply pressure on victims to pay.

Related Content:

How Ransomware Defense Is Evolving With Ransomware Attacks

Special Report: How IT Security Organizations are Attacking the Cybersecurity Problem

New From The Edge: AI and APIs: The A+ Answers to Keeping Data Secure and Private

What hasn't changed is what we call it: ransomware. That's a mistake, since it ties it in too many people's minds to the past, and to a much less threatening form of the attack, the attack form that started in 1989 with the AIDS Trojan (distributed on 20,000 floppy disks and looking for a payment of around $500). The attack returned in the mid-2010s, but as individual threats. Attacks such as CryptoWall, Cryaki, TeslaCrypt, and CTB-Locker impacted individual users and forced the victim to approach the attacker to recover. Attackers also took rapid advantage of cryptocurrencies, using the relative anonymity and easy transferability of Bitcoin to protect them as they monetized their efforts.

These attacks were distributed by multiple means, or vectors. Phishing, pop-ups from malvertising, and even messaging on platforms like Facebook Messenger were common vectors. The code base was different, the attack vector was different, but the goal was the same. Land on a user's computer, encrypt that computer and network-accessible data, and demand payment. The attack was against the individual, and corporate damage was a bonus (in terms of payment), not the objective. The ransom was to decrypt the locked data, and defensive tactics focused on limiting access to data — least privilege, user-awareness training, and host-based malware prevention.

This model slowly shifted toward corporate targets, as the bad guys followed the money. 2020, however, saw a series of seminal shifts in the landscape, and a change in tactics. This series of shifts is why we should change the naming — from ransomware, a serious attack but one with a relatively narrow scope, to extortionware, where every pressure is being applied to force payment.

The first shift was in the maturity of the attacker. Ransomware was a wide net, and encryption was an early part of the attack. With extortionware, the attacking crews have adopted advanced tactics or have purchased access from initial access brokers in order to fully monetize a compromise. Rather than land and encrypt, the model is what you'd expect in a data breach: perform an initial compromise, expand laterally, escalate privilege, locate important data (and backups), and only when holding a commanding position does the attacker execute the coup de grâce and encrypt the data.

This alone isn't enough to change the name of a class of attack. The biggest change is that this type of attack is no longer just a demand for a ransom to decrypt data. Starting with the Maze crew in May 2020, the attackers started to exfiltrate the data before encrypting it. A victim was placed in double jeopardy; even if the target were able to recover from backup or brute-force encryption, confidential data could be leaked.

By the start of 2021, this tactic was being widely adopted with at least Revil, Netwalker, and Mespinoza adopting it. Attackers added distributed denial-of-service to their arsenal by October 2020, and even started pressuring victims via social media to up the stakes. Finally, toward the end of 2020, threats were made to deliberately disclose compromising and damaging information that executives had divulged internally.

Calling this ransomware ties it in too many people's minds to the older attacks and downplays the current threat. We have to change perception and the branding. We can label the trend as what it is — not just a ransom to get your data unencrypted, but extortion by all means. We should call it something more threatening. Whether we call it extortionware or something else, we cannot continue to treat it just as a data availability issue.

Our approach to the threat must change — the reason for changing how we refer to it. Data protection is going to remain imperative, and immutable backup is a key part of that protection strategy. But it cannot be the only part. We have to ensure that we are using the whole security suite to detect these attacks before we need to restore, and to limit the scope of damage if it occurs. We have to start with a strategy and our security must be adaptive because the attack is adapting. For now, key controls will be strong and contextual identity, microsegmentation, and robust vulnerability management programs. None of these are new, but their relevance and importance are.

This story was updated on March 11, 2021.

Charlie Winckless is the Senior Director of Cybersecurity Solutions for Presidio, setting strategic direction both internally to Presidio and helping clients build digital trust. He is a cybersecurity veteran with over 20 years' experience in the field and cut his IT teeth at ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-06-20
The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin WordPress plugin before 7.1.18 did not sanitise or escape its result_id parameter when displaying an existing quiz result page, leading to a reflected Cross-Site Scripting issue. This c...
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.