Double extortion (二重脅迫) is a ransomware tactic in which the attacker not only encrypts data and charges for decryption but also threatens to publish data stolen beforehand to extract money.
Break into the network
Copy data out
Encrypt the data inside
Demand money for decryption and silence
The ransom demand rests on two promises: restoring the data and keeping it private.
4 / 4
The attacker first gets into the organization’s network and copies important data out before encrypting it. So even if the victim can restore everything from backups, the demand to pay in exchange for not publishing the data remains. The stolen data is sometimes posted on sites on the dark web, covered later in this unit.
AnalogyPicture a burglar who locks your safe and sells you the combination, but also walks off with copies of the papers inside and threatens to hand them out to the neighbors unless you pay.
Exam points
Mix-upConventional ransomware (ランサムウェア) relies only on making data unusable through encryption, while double extortion (二重脅迫) also uses the threat of publication. Backups alone therefore cannot fully contain the damage.
Double extortion (ダブルエクストーション) is the English name, written in katakana, for the tactic known in Japanese as 二重脅迫 (double extortion); both refer to exactly the same thing.
In Japanese the term is just the English phrase written in katakana, and it likewise combines encryption with the threat of publication. Security news and reports use both the Japanese name and the English-derived one.
How to rememberExtortion means obtaining money through threats; add double and you get two threats at once.
Exam points
Mix-upThe “double” in double extortion (ダブルエクストーション) refers to two kinds of leverage. It does not mean two separate intrusions or two kinds of malware.
The dark web (ダークウェブ) is a body of online content with a high degree of anonymity: ordinary search services do not find it, and some of it can only be reached with special software.
Because it is hard to trace who posts or visits, it is readily abused for selling stolen personal data and account credentials or for hiring out attacks. Sites that publish data stolen in double extortion attacks are sometimes hosted there too.
AnalogyIt is like a back-alley market with no sign and no address, where nobody knows who the customers really are.
How to rememberDark means out of the light; think of it as the place a search engine’s light never reaches.
Exam points
ExamThe dark web (ダークウェブ) does not show up in search results and is highly anonymous, so it is sometimes used for crime-related dealings.
Mix-upThe dark web is the body of content you reach, not the name of the special software that is sometimes used to reach it.
File-sharing software (ファイル交換ソフトウェア) lets users’ computers connect directly to one another to exchange files, mostly using a P2P (peer-to-peer) design.
Get a file of unknown origin
The PC that opens it is infected
Documents on the PC become shared
The documents spread to many users
Other users keep downloading them, so once the documents spread they are almost impossible to recall.
4 / 4
The files passed around are hard to trace to a source, so downloading a fake file with malware hidden in it becomes a route to infection. Depending on the malware, documents on the PC that were never meant to be shared can end up in the exchange area and spread to many users. Once a file has spread, it is almost impossible to recall.
AnalogyIt is like a swap meet where strangers hand each other parcels with no sender’s name. Nobody has checked whether what is inside is safe.
How to rememberA peer is an equal; picture a setup where there is no difference between the side that gives and the side that receives.
Exam points
Mix-upUsers of file-sharing software (ファイル交換ソフトウェア) can do more than get infected. After infection they can become the source that leaks documents from their own PC.
Spam email (迷惑メール) is email that recipients do not want, sent to them unilaterally for advertising, fraud, distributing malware and similar purposes.
Blacklist method
Whitelist method
Senders you register
Ones you want to block
Ones you want to receive
Senders not registered
Received
Not received
Good for
Stopping specific nuisance senders
Exchanging mail only with set contacts
The basic response is to delete it without replying and without opening any links or attachments in it. Replying tells the sender the address is actually in use, which can bring in even more mail. On the receiving side, mail can be sorted with a blacklist method that registers senders to reject or a whitelist method that registers senders to accept.
AnalogyIt is like flyers nobody asked for being stuffed into your mailbox, with a few among them pretending you won a prize so they can get your contact details.
Exam points
ExamReplying to spam email (迷惑メール) to complain tells the sender the address is valid, so do not reply.
ExamA whitelist (ホワイトリスト) method registers the addresses of senders you want to hear from and accepts mail only from them.
Spam (スパム) means messages sent in bulk to anyone at all without the recipients’ consent; in email it refers to the same thing as spam email (迷惑メール).
Spam sent by email is also called spam mail, and the same word is used for mass posting on message boards and social media. A similar nuisance is the chain letter, which asks in its text to be forwarded to many people and spreads as each recipient passes it on.
How to rememberThe word is said to come from a British comedy sketch in which the brand name of a canned meat is chanted over and over.
Exam points
ExamSpam email (スパムメール) is email sent to arbitrary addresses without the recipients having agreed to receive it.
ExamA chain letter (チェーンメール) is forwarded on by one recipient after another, and as the copies pile up they put extra load on networks and servers.
Mix-upSpam is blasted out by the sender all at once, while a chain letter spreads through recipients forwarding it, so they multiply in different ways.
二重脅迫 and ダブルエクストーション are the Japanese and katakana-English names for the same tactic, double extortion, which pairs encryption with the threat of publication.
The dark web is sometimes where data stolen in double extortion attacks is published or sold.
With file-sharing software, opening a file of unknown origin is the way in for infection, and afterwards documents on the PC may leak.
Do not reply to spam email; delete it without opening its links or attachments.
In email, spam (スパム) is the same thing as spam email (迷惑メール), i.e. unsolicited mail.