Double Extortion
Definition
A ransomware tactic in which the attacker exfiltrates data before encrypting it, then demands payment both for the decryption key and for non-publication of the stolen data. First observed at scale with the Maze ransomware group in 2019, now standard practice among organised ransomware operations.
- Mechanism
- Data exfiltrated before encryption
- Second demand
- Payment demanded for both decryption and non-publication
- First observed at scale
- Maze ransomware group, 2019
- Status
- Standard practice among organised ransomware operators
Common questions
Why does double extortion defeat backup-based ransomware defences?+
Restoring encrypted files from backup neutralises the encryption threat, but it does nothing about data the attacker already copied out. Because the second threat is publication of stolen data, clean backups no longer remove the attacker's advantage, which is why double extortion emerged as backup practices improved.
What evidence helps establish that exfiltration actually occurred in a double-extortion case?+
Investigators look for outbound data transfers to unfamiliar external IP addresses or cloud storage endpoints in network logs, unusual archive or compression tool activity shortly before encryption, and any sample data the attacker posts on a leak site, which can be compared against internal records to confirm authenticity.
Related terms
- Command and Control (C2)
- The channel through which an attacker sends instructions to malware on a compromised host and receives data back. C2 channels range from...
- Credential Stuffing
- An automated attack that replays username-password pairs from previous data breaches against new target services, exploiting the widespread reuse of passwords across...
- FAFT Virtual Asset Guidance
- Guidance from the Financial Action Task Force requiring member states to regulate virtual asset service providers (cryptocurrency exchanges) as financial institutions, applying...
- Image-Based Sexual Abuse (IBSA)
- The non-consensual creation, capture, or distribution of intimate sexual images. The term encompasses non-consensual intimate image sharing (formerly called revenge porn), upskirt...
- Synthetic Identity Fraud
- The creation of a fictitious identity by combining real and fabricated personal data elements, such as a genuine national ID number paired...