OXFORD, U.K.  — Ottobre 28, 2021 —

Sophos, a global leader in next-generation cybersecurity, has published an article, “The Top 10 Ways Ransomware Operators Ramp Up the Pressure to Pay,” detailing how ransomware attackers are implementing a wide range of ruthless pressure tactics to persuade victims to pay the ransom. The article is based on evidence and insight from Sophos’ Rapid Response team of 24/7 incident responders who help organizations under active cyberattack. It highlights the shift in ransomware pressure techniques from solely encrypting data to including other pain points, such as harassing employees.  

“Since organizations have become better at backing up their data and restoring encrypted files from backups, attackers are supplementing their ransom demands with additional extortion measures that increase the pressure to pay,” said Peter Mackenzie, director, Incident Response at Sophos. “For  example, the Sophos Rapid Response team has seen cases where attackers email or phone a victim’s employees, calling them by their name and sharing personal details they’ve stolen – such as any disciplinary actions or passport information – with the aim of scaring them into demanding their employer pays the ransom. This kind of behavior shows how ransomware has shifted from a purely technical attack targeting systems and data into one that also targets people.”

The article includes a recorded voicemail that a SunCrypt ransomware affiliate left for an employee of a targeted organization (published with the permission of the affected organization.)

How Attackers Ramp Up the Pressure to Pay

Below are the top 10 ways attackers are increasing pressure on their ransomware victims to get them to pay the ransom:

  1. Stealing data and threatening to publish or auction it online
  2. Emailing and calling employees, including senior executives, threatening to reveal their personal information
  3. Notifying or threatening to notify business partners, customers, the media, and more of the data breach and exfiltration  
  4. Silencing victims by warning them not to contact the authorities
  5. Recruiting insiders to help them breach networks
  6. Resetting passwords
  7. Phishing attacks targeting victim email accounts
  8. Deleting online backups and shadow volume copies
  9. Printing physical copies of the ransom note on all connected devices, including point of sale terminals  
  10. Launching distributed denial-of-service attacks against the target’s website

The article explains each tactic in more detail, with examples of ransomware groups that have deployed that tactic. The article also includes advice on what defenders can do to protect their organization and employees from attacker behaviors and cyberthreats in general.

Further information on attacker behaviors, real-world incident reports and advice for security operations professionals is available on Sophos News SecOps.

Tactics, techniques and procedures (TTPs), and more, for different types of ransomware are available on SophosLab Uncut, the home of Sophos’ latest threat intelligence.

Informazioni su Sophos

Sophos è un’azienda leader nell’ambito della cybersecurity e protegge 600.000 organizzazioni in tutto il mondo con una piattaforma basata sull’IA e servizi a cura di esperti. Sophos viene incontro alle esigenze delle organizzazioni, adattandosi al loro livello di maturità di sicurezza informatica e crescendo insieme ai clienti per tutelarli dai cyberattacchi. La sua soluzione offre la combinazione ottimale tra machine learning, automazione e dati di intelligence sulle minacce in tempo reale, aggiungendo le competenze umane degli esperti del team Sophos X-Ops, che lavorano in prima linea per garantire monitoraggio, rilevamento e risposta alle minacce 24/7.
Sophos offre un servizio di Managed Detection and Response (MDR) leader di settore, nonché una linea completa di tecnologie di sicurezza, tra cui soluzioni per la protezione di endpoint, rete, e-mail e cloud, nonché Extended Detection and Response (XDR), rilevamento delle minacce all’identità (Identity Threat Detection and Response, ITDR) e SIEM next-gen. Unite a servizi di consulenza a cura di esperti, queste funzionalità aiutano le organizzazioni a ridurre proattivamente il rischio e a rispondere in maniera più tempestiva, ottenendo il giusto livello di visibilità e scalabilità richiesto per tenersi un passo avanti rispetto a minacce in continua evoluzione.
La strategia go-to-market di Sophos si basa su un ecosistema di Partner che include Managed Service Provider (MSP), Managed Security Service Provider (MSSP), Rivenditori e Distributori, integrazioni per il marketplace, e Partner Cyber Risk; questa strategia offre alle organizzazioni la flessibilità di scegliere come stabilire rapporti di fiducia per la protezione della loro attività.  Sophos ha sede a Oxford, nel Regno Unito. Ulteriori informazioni sono disponibili su www.sophos.it.