Learn in the textbookMalware Distribution Routes and Extortion Tactics
DefinitionDouble extortion (二重脅迫) is a ransomware tactic in which the attacker not only encrypts data and charges for decryption but also threatens to publish data stolen beforehand to extract money.
ExplanationThe attacker first gets into the organization’s network and copies important data out before encrypting it. So even if the victim can restore everything from backups, the demand to pay in exchange for not publishing the data remains. The stolen data is sometimes posted on sites on the dark web, covered later in this unit.
AnalogyPicture a burglar who locks your safe and sells you the combination, but also walks off with copies of the papers inside and threatens to hand them out to the neighbors unless you pay.