Ransomware Groups Weaponize Stolen Data to Increase Pressure on Targets Who Refuse to Pay, Sophos Report Finds

 Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released a new dark web report, “Turning the Screws: The Pressure Tactics of Ransomware Gangs,” which details how cybercriminals are weaponizing stolen data to increase pressure on targets who refuse to pay.

This includes sharing the contact details or doxing the family members of targeted CEOs and business owners, as well as threatening to report any information about illegal business activities uncovered in stolen data to the authorities.

In the report, Sophos X-Ops shares posts found on the dark web that show how ransomware gangs refer to their targets as “irresponsible and negligent,” and in some cases, encourage individual victims whose personal information was stolen to pursue litigation against their employer.

“In December 2023, in the wake of the MGM casino breach, Sophos began taking note of ransomware gangs’ propensity to turn the media into a tool they can use to not only increase pressure on their victims but take control of the narrative and shift the blame. We are also seeing gangs singling out the business leaders they deem ‘responsible’ for the ransomware attack at the companies they target. In one post we found, the attackers published a photo of a business owner with devil horns, along with their social security number. In a different post, the attackers encouraged employees to seek ‘compensation’ from their company, and, in other cases, the attackers threatened to notify customers, partners and competitors about data breaches. These efforts create a lightning rod for blame, increasing the pressure on businesses to pay up and potentially exacerbating the reputational damage from an attack,” said Christopher Budd, director, threat research, Sophos.

Sophos X-Ops also found multiple posts by ransomware attackers detailing their plans to search for information within stolen data that could be used as leverage if companies don’t pay. For example, in one post, the WereWolves ransomware actor notes that any stolen data is subject to “a criminal legal assessment, a commercial assessment and an assessment in terms of insider information for competitors.” In another example, the ransomware group Monti noted that it found an employee at a targeted company searching for child sexual abuse material and threatened to go to the police with the information if the company didn’t pay the ransom.

These posts align with a broader trend of criminals seeking to extort companies with increasingly sensitive data relating to employees, clients or patients, including mental health records, the medical records of children, “information about patients’ sexual problems” and “images of nude patients.” In one ransomware case, the Qiulong ransomware group posted the personal data of a CEO’s daughter, as well as a link to her Instagram profile.

“Ransomware gangs are becoming increasingly invasive and bold about how and what they weaponize. Compounding pressure for companies, they’re not just stealing data and threatening to leak it, but they’re actively analyzing it for ways to maximize damage and create new opportunities for extortion. This means that organizations have to not only worry about corporate espionage and loss of trade secrets or illegal activity by employees, but also about these issues in conjunction with cyberattacks,” said Budd.

Read the full report “Turning the Screws: The Pressure Tactics of Ransomware Gangs” on Sophos.com.

Learn More About

• How ransomware actors are weaponizing the media in Press and pressure: Ransomware Gangs and the Media
• The evolving ransomware business model in Junk Gun’ Ransomware: Peashooters Can Still Pack a Punch
• Current and evolving ransomware tactics in the 2024 Sophos Threat Report: Cybercrime on Main Street
• The State of Ransomware 2024
• The role of law enforcement in ransomware attacks
• The latest techniques, tactics and procedures (TTPs) of cyber attackers in the Active Adversary Report for 1H 2024
• The effect of cyber insurance on the ransomware landscape
• How often companies’ backups are compromised during ransomware attacks
• The role of unpatched vulnerabilities in ransomware attacks
• The rise of remote encryption among ransomware groups
• Sophos X-Ops and its groundbreaking threat research by subscribing to the Sophos X-Ops blogs

About Sophos

Sophos is a global leader and innovator of advanced security solutions for defeating cyberattacks, including Managed Detection and Response (MDR) and incident response services and a broad portfolio of endpoint, network, email, and cloud security technologies. As one of the largest pure-play cybersecurity providers, Sophos defends more than 600,000 organizations and more than 100 million users worldwide from active adversaries, ransomware, phishing, malware, and more. Sophos’ services and products connect through the Sophos Central management console and are powered by Sophos X-Ops, the company’s cross-domain threat intelligence unit. Sophos X-Ops intelligence optimizes the entire Sophos Adaptive Cybersecurity Ecosystem, which includes a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity and information technology vendors. Sophos provides cybersecurity-as-a-service to organizations needing fully managed security solutions. Customers can also manage their cybersecurity directly with Sophos’ security operations platform or use a hybrid approach by supplementing their in-house teams with Sophos’ services, including threat hunting and remediation. Sophos sells through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.