CYBER SECURITYNews

Sophos Rapid Response Details Top Ways Ransomware Attackers Ramp up Pressure to Pay


Cybersecurity firm Sophos has published an article detailing how ransomware attackers are implementing a wide range of ruthless pressure tactics to persuade victims to pay the ransom.

The article is based on evidence and insight from Sophos’ Rapid Response team of 24/7 incident responders who help organizations under active cyberattack. It highlights the shift in ransomware pressure techniques from solely encrypting data to including other pain points, such as harassing employees.   

“Since organizations have become better at backing up their data and restoring encrypted files from backups, attackers are supplementing their ransom demands with additional extortion measures that increase the pressure to pay,” said Peter Mackenzie, director, Incident Response at Sophos.

“For example, the Sophos Rapid Response team has seen cases where attackers email or phone a victim’s employees, calling them by their name and sharing personal details they’ve stolen – such as any disciplinary actions or passport information – with the aim of scaring them into demanding their employer pays the ransom. This kind of behavior shows how ransomware has shifted from a purely technical attack targeting systems and data into one that also targets people.” 

The article includes a recorded voicemail that a SunCrypt ransomware affiliate left for an employee of a targeted organization (published with the permission of the affected organization.)

The attackers are increasing pressure on their ransomware victims to get them to pay the ransom by stealing data and threatening to publish or auction it online, emailing and calling employees, including senior executives, threatening to reveal their personal information, notifying or threatening to notify business partners, customers, the media, and more of the data breach and exfiltration and silencing victims by warning them not to contact the authorities

They are also recruiting insiders to help them breach networks, reset passwords, conduct phishing attacks targeting victim email accounts, deleting online backups and shadow volume copies. printing physical copies of the ransom note on all connected devices, including point of sale terminals as well as aunching distributed denial-of-service attacks against the target’s website

The article explains each tactic in more detail, with examples of ransomware groups that have deployed that tactic. The article also includes advice on what defenders can do to protect their organization and employees from attacker behaviors and cyberthreats in general. 

Follow us on TelegramTwitterFacebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendske.co.ke.

Facebook Comments

Deloitte's Aasif Karachi on Upskilling and their partnership with AWS | TechTrends

TechTrends Media Editorial

Tracking and reporting on tech and business trends in Kenya and across Africa. Send tips to editorial@techtrendsmedia.co.ke

Have anything to add to this article? Leave us a comment below

Back to top button

Discover more from TechTrendsKE

Subscribe now to keep reading and get access to the full archive.

Continue reading