Double extortion
noun · CISA #StopRansomware Guide
A ransomware tactic in which attackers steal data before encrypting it, then threaten to publish it to pressure the victim into paying.
Early ransomware only encrypted files, so an organization with good backups could restore and refuse to pay. Attackers adapted: before encrypting anything, they copy sensitive data out of the network. The victim then faces two threats at once, systems that do not work and stolen data that will be published on a leak site if the ransom is not paid. CISA's ransomware guide describes this combination as double extortion, and notes that some groups now skip encryption entirely and extort with stolen data alone.
Double extortion changes what backups can solve. Backups bring systems back, but they do nothing about data that has already left, which turns a ransomware incident into a data breach with legal and notification consequences.
Example
An attacker spends several days in a network, compresses file shares holding HR and finance records, and uploads them to a cloud storage service. Only then do they deploy ransomware. The company restores from backups within a week, but the attackers publish a sample of the stolen records and demand payment to keep the rest private.
Why it matters for a SOC analyst
Exfiltration happens before encryption, which gives defenders a window. Large outbound transfers, archiving tools on servers and connections to file-sharing services from hosts that never use them are signs worth investigating before the ransomware arrives.
Articles that use this term
Threat Analysis · · 5 min read
The first days of a ransomware intrusion: what happens before the encryption
Ransomware is the last step of an intrusion that often runs for days. A stage-by-stage look at what attackers do first and where defenders can stop them.
Related terms
- Ransomware
Malware that encrypts an organization's data and demands payment for the key, often after stealing the data to threaten its release.
- Data exfiltration
The unauthorized transfer of data out of an organization, often the attacker's main goal or the leverage behind a ransomware extortion.
- Data breach
A confirmed incident in which protected data, such as personal or confidential information, was accessed, disclosed or stolen without authorization.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.