Double Extortion Ransomware

Double extortion does not necessarily involve multiple extortions, but rather the cybercriminals use several means of pressure for their extortion.

In most cases of ransomware attacks, there is usually one means of pressure: the data of a computer, network or system is encrypted. A ransom is demanded for decryption.

With double extortion ransomware, the cybercriminals add further means of pressure to make the ransom payment as unavoidable as possible for the extorted company.

What exactly does Double Extortion mean?

With Double Extortion Ransomware, cybercriminals can put pressure on their victims by using various means:

• Sensitive data such as personal information or company secrets. The cybercriminals copy this data before encrypting the system. If the ransom is not paid, they then threaten to publish this data or auction it on the darknet.
• DDoS attacks, with which cyber criminals render the website of the blackmailed company unusable.
• Violations of the company against regulations, e.g. against the GDPR, detected by the cyber criminals. Then the ransom demands are often lower than the expected fine.

Where do I face Double Extortion Ransomware in everyday life?

Whether Ransomware or Double Extortion Ransomware – cyber criminals often try to place the malware through phishing emails. So if you detect such an email, it may be that you have just fended off a Double Extortion Ransomware attack.

But you can also be affected by Double Extortion Ransomware without your intervention. For example, the major cyberattack on Mediamarktsaturn in 2021 was carried out by cybercriminals known for Double Extortion Ransomware. In such cases, it can happen that data of customers of the affected company is published. However, to our knowledge, this was not the case after the aforementioned cyberattack.

What can I do to improve my safety?

Cybercriminals use different attack methods for double extortion ransomware. These include phishing emails, brute force attacks on remote access to the corporate network as well as access data bought on the darknet to already compromised networks. Many, but not all, of these attacks can be prevented.

Therefore, we recommend a two-track protection strategy: on the one hand, preventing successful attacks (prevention) and, on the other hand, limiting the damage caused by successful attacks (reaction).