Sophos, which provides security solutions for defeating cyberattacks, released a new dark web report: Turning the Screws: The Pressure Tactics of Ransomware Gangs. This report details how cybercriminals are weaponizing stolen data to increase pressure on targets who refuse to pay. This includes sharing contact details, doxing targets’ families and threatening to report illegal business activity.
Sophos X-Ops noted that ransomware gangs refer to their targets as “irresponsible and negligent,” and in some cases, encourage individual victims whose personal information was stolen to pursue litigation against their employer.
“In December 2023, in the wake of the MGM casino breach, Sophos began taking note of ransomware gangs’ propensity to turn the media into a tool they can use to not only increase pressure on their victims but take control of the narrative and shift the blame,” said Christopher Budd, Sophos director of threat research. “We are also seeing gangs singling out the business leaders they deem ‘responsible’ for the ransomware attack at the companies they target. In one post we found, the attackers published a photo of a business owner with devil horns, along with their social security number. In a different post, the attackers encouraged employees to seek ‘compensation’ from their company, and, in other cases, the attackers threatened to notify customers, partners and competitors about data breaches. These efforts create a lightning rod for blame, increasing the pressure on businesses to pay up and potentially exacerbating the reputational damage from an attack.”
Sophos X-Ops uncovered multiple posts by ransomware attackers, detailing their plans to search for information within stolen data that could be used as leverage if companies don’t pay. These posts align with a broader trend of criminals seeking to extort companies with increasingly sensitive data relating to employees, clients or patients, including mental health records, the medical records of children, “information about patients’ sexual problems” and “images of nude patients.”
“Ransomware gangs are becoming increasingly invasive and bold about how and what they weaponize,” said Budd. “Compounding pressure for companies, they’re not just stealing data and threatening to leak it, but they’re actively analyzing it for ways to maximize damage and create new opportunities for extortion. This means that organizations have to not only worry about corporate espionage and loss of trade secrets or illegal activity by employees, but also about these issues in conjunction with cyberattacks.”
Read the full report here. For Sophos’ channel partner program, click here.
