Chapter 1
Impact
Heck, what’s a little extortion among friends?
—Bill Watterson
Learning Objectives
Define cyber extortion and explain the four types (denial, exposure, modification, and “faux”)
Understand the impacts of cyber extortion on modern organizations
Recognize that adversaries can leverage technology suppliers to compromise victims and conduct cyber extortion on a massive scale
Company X was a thriving accounting firm headquartered in a major U.S. city. Every day, its staff handled bookkeeping, financial oversight, tax preparation, and a myriad of other tasks for hundreds of clients.
Suddenly, one Monday morning, everything stopped. An early-rising staff member walked into the office and heard a frightening sound. Every computer was shouting a message: “Attention! What happened? All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms. You cannot access the files right now. But do not worry. You have a chance!”
Scattered around the office were papers everywhere. All of the printers in the office had printed the ransom note, over and over, until the paper trays were empty. The point-of-sale systems that staff used to process credit cards had spit out the ransom notes on printed receipts, over and over, until the long reams spilled off the desks.
A chilling voicemail awaited one of the firm’s partners: “Hello, Mr. [REDACTED],” stated an emotionless male voice with an Eastern European accent, “I’d like to notify you that we downloaded 500 gigabytes of data from your servers. If you’re planning to just restore your data without paying for decryption, we’ll sell your company’s data on darknet.
“Unless you contact us ASAP, we’ll notify all of your clients that we are in possession of their private data, like Social Security numbers and tax forms. We urge you to get in touch with us using the email from the text file we’ve placed on your desktop.”
The voice paused for effect. “If we leak that data, your business will be as good as gone. We are looking forward to receiving your reply via email.”
Click. With that, the voicemail ended.
The criminals demanded $1.2 million to restore access, and refrain from publishing the client data.
In the meantime, the firm was down. Databases containing client files were fully encrypted and unusable. Employees couldn’t access shared folders, including client documents, firm payroll details, human resources (HR) data, and more. All of the clients that depended on them for daily bookkeeping or time-sensitive services were stuck.
Fortunately, the firm’s cloud-based email was still available, too—and the criminals leveraged that. “Good morning,” the criminals wrote in a follow-up email. “I think you still cannot understand what situation your company is in now. … First of all, we will sell the personal data of your employees and customers on the market. … [You] will be sued by both your employees and your clients.” The criminals attached the partners’ own personal tax returns to the email to illustrate the threat.
It quickly became clear that the criminals had hacked the firm’s email accounts as well and were monitoring the victim’s response. “We also saw the report that [antivirus vendor] provided you,” the criminals wrote. “It contains many errors.”
The criminals had a playbook. Day in and day out, they held organizations hostage using the Internet. First, they gained access to their victim’s network. For Company X, the initial hack occurred in May, when an employee opened an attachment in a phishing email. The employee’s computer was infected with malware—specifically, a remote access Trojan (known as a “RAT”), which gave the criminals remote access to the employee’s computer.
Company X’s antivirus software did not detect the infection. The criminals lurked for about three months. They occasionally logged in to the employee’s computer remotely, presumably to check that their access still worked, but did little else. It is possible that during this time, these criminals simply peddled access to the hacked computer on the dark web. Hackers known as “initial access brokers” specialize in gaining access to computers. They then sell this access to other criminals, and in this way quickly turn their crime into profit. The purchasers—often organized crime groups—then take the next step of exploring the victim’s network, stealing data and potentially holding them for ransom.
Suddenly, in August, criminals later identified as the Twisted Spider ransomware gang1 remotely logged onto the employee’s infected computer. Using common penetration testing tools, they stole passwords from the employee’s computer, including the username and password of the managed service provider (MSP) that remotely administered the company’s computers. Then, they used these credentials to take full control of Company X’s network.
1. Jon DiMaggio, Ransom Mafia: Analysis of the World’s First Ransomware Cartel (Analyst1, April 7, 2021), https://analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf.
The Twisted Spider gang went straight for the heart: They copied all of the files from the firm’s primary data repository. Then, they installed fast and effective ransomware software that encrypted all of the company’s servers, including databases, application servers, domain controllers, and more. They left workstations alone, not bothering to comb through individual accounts or computers. It was like a well-executed smash-and-grab.
The criminals knew their victims’ pain points. They knew that the short-term business interruption was impactful, but even more devastating were the potential long-term consequences that could arise from angry clients who were upset that their data was stolen. The Twisted Spider hackers made sure to demonstrate that they had access to sensitive, regulated information, ranging from Social Security numbers to tax details. They explicitly reminded the victim’s executives that they could be sued by employees and clients. They made it clear that they were prepared to publish the data and directly contact affected clients so as to damage the firm’s reputation. This, in turn, could lead to loss of business, plus lawsuits, threatening the firm’s very survival.
Company X paid the ransom—or rather, their cyber insurance firm paid the ransom, less a $25,000 deductible. The authors of this book were called to handle the negotiation and successfully obtained a hefty discount, settling the case for a little less than $600,000. Not surprisingly, Twisted Spider appeared to leverage inside information during the negotiations: Company X had an insurance policy with a ransomware sublimit of $600,000.
Once Twisted Spider verified that the money was received (in the form of cryptocurrency), the criminals provided preconfigured software to decrypt the encrypted files, and “confirmed” via chat that they had deleted the data. They even created a full list of all files that they claimed to have deleted, and shared this via email, presumably to provide the victim with documentation that could assuage client concerns or negate the need for notification. However, Company X’s cyber lawyers determined that notification was required anyway, for both legal and ethical reasons.
1.1 A Cyber Epidemic
Company X was not alone in suffering such an attack. Thousands (if not millions) of organizations have been hit with cyber extortion over the past decade. What was once a novel crime has become mainstream—at great cost to society.
Cyber extortion attacks have shuttered hospitals, forced school closures, disrupted the food supply, and even caused large-scale fuel shortages. Today, ransomware attacks are also being pushed out to thousands of organizations simultaneously through the technology supply chain.
The cost of ransomware was estimated to hit $20 billion in 2021, and is predicted to balloon to $265 billion by 2031, according to research firm Cybersecurity Ventures.2 In a global survey, 37% of organizations reported that they were hit by ransomware attacks in 2020,3 although the full scale of the problem is impossible to assess because many victims do not report the crime.4
2. David Braue, “Global Ransomware Damage Costs Predicted to Exceed $265 Billion by 2031,” Cybercrime Magazine, June 2, 2022, https://cybersecurityventures.com/global-ransomware-damage-costs-predicted-to-reach-250-billion-usd-by-2031/.
3. Sophos, The State of Ransomware 2021, 2021, https://secure2.sophos.com/en-us/medialibrary/pdfs/whitepaper/sophos-state-of-ransomware-2021-wp.pdf.
4. Danny Palmer, “Ransomware Victims Aren’t Reporting Attacks to Police. That’s Causing a Big Problem,” ZDNet, October 5, 2020, www.zdnet.com/article/ransomware-victims-arent-reporting-attacks-to-police-thats-causing-a-big-problem/.
Propelled by their success, cybercriminals have invested in increasingly sophisticated cyber extortion technology and business models. Cyber extortion has evolved from small, one-off attacks to a bustling criminal economy, with franchises, affiliates, specialized software, and user-friendly playbooks.
Defenders need to ramp up their efforts, too. It is possible to dramatically reduce the damage of a cyber extortion crisis, or even prevent one altogether, by acting quickly and strategically in response to prodromal signs of an attack. Given that cyber extortion tactics evolve quickly, defenders’ tactics must constantly adapt as well.
In this chapter, we first build a foundation by evaluating the impacts of cyber extortion and understanding how this crime has evolved. Then, we discuss key technological advancements that have facilitated the expansion of ransomware specifically, as well as other forms of cyber extortion. Modern cyber extortion gangs have adopted scalable business models that often involve affiliates and industry specialists, and increasingly leverage threats of data exposure. We conclude by analyzing the next-generation cyber extortion business model, which will provide context for the response and prevention tactics introduced throughout this book.
1.2 What Is Cyber Extortion?
Definition: Cyber Extortion
Cyber extortion is an attack in which an adversary attempts to obtain something of value by threatening the confidentiality, integrity, and/or availability of information technology resources.
Extortion is a crime that has evolved along with humanity. It refers to the act of obtaining something of value “by force, intimidation, or undue or illegal power.”5 As the Internet evolved and organizations around the world came to depend upon computing resources to operate, cybercriminals adapted old tactics to this new digital world.
5. “Extortion,” Merriam-Webster, www.merriam-webster.com/dictionary/extortion.
1.2.1 CIA Triad
To create leverage, adversaries threaten one or more of the three security objectives for information and information systems, as defined by the Federal Information Security Management Act (FISMA) of 2002:
Confidentiality
Integrity
Availability
Colloquially, these three objectives are known as the “CIA Triad,” based on their acronym.6 The CIA Triad was specifically designed for use by departments, vendors, and contractors of the federal government; however, it has been widely adopted by other organizations and the information security community itself. Although cyber extortion can violate any of the three CIA objectives, today’s adversaries most commonly threaten confidentiality and availability.
6. “Standards for Security Categorization of Federal Information and Information Systems,” National Institute of Standards and Technology, Computer Security Division, Information Technology Laboratory, February 2004, https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf.
1.2.2 Types of Cyber Extortion
Cyber extortion attacks fit into one of four categories—exposure, modification, denial, or faux:
Exposure: Threatens the confidentiality of information resources. For example, an adversary may steal data from a victim, and threaten to either publish or sell it unless a ransom is paid.
Modification: Threatens the integrity of information resources. An adversary can modify key elements of an organization’s data, such as patient records or bank transactions, and demand a payment in exchange for restoring the original data or identifying the changes.7 This type of attack is rare at the time of this writing, but adversaries may decide to leverage it in the future, particularly if scalable modification tools are developed.
7. “Enterprise Ransomware,” CyberCube, 2022, https://insights.cybcube.com/enterprise-ransomware-report.
Denial: Threatens the availability of information resources. Ransomware attacks are the most common example of denial extortion. In these cases, an adversary encrypts a victim’s files and refuses to release the decryption key unless a ransom is paid. Distributed denial-of-service (DDoS) attacks have also been used by adversaries to create leverage for extortion.8,9
8. Lance Whitney, “How Ransomware Actors Are Adding DDoS Attacks to Their Arsenals,” TechRepublic, June 2, 2021, www.techrepublic.com/article/how-ransomware-actors-are-adding-ddos-attacks-to-their-arsenals/.
9. Lawrence Abrams, “Ransomware Gangs Add DDoS Attacks to Their Extortion Arsenal,” Bleeping Computer, October 1, 2020, www.bleepingcomputer.com/news/security/ransomware-gangs-add-ddos-attacks-to-their-extortion-arsenal/.
Faux: An attack that appears to be cyber extortion, but in fact is not. For example, the destructive “NotPetya” malware masqueraded as ransomware, but was actually designed to destroy the victim’s systems with no hope of recovery. (See Chapter 7 for more details on the NotPetya attacks.)
A Word About the “Adversary”
When we use the term “adversary” throughout this book, we are referring to the collection of actors involved in executing a cyber extortion attack, and not necessarily to a single actor.
Modern cyber extortion attacks often involve many different actors. For example, an “initial access broker” may gain the first entry into a victim’s network, and then sell or rent access to other adversaries.10 Sophisticated cyber extortion gangs may have employees or contractors with specialized skill sets that are employed at various stages of an attack. For simplicity, all of these actors are included when we refer to the “adversary” throughout this book.
10. Victoria Kivilevich and Raveed Laeb, “The Secret Life of an Initial Access Broker,” KELA, August 6, 2020, https://ke-la.com/the-secret-life-of-an-initial-access-broker/.
1.2.3 Multicomponent Extortion
Increasingly, adversaries use multiple forms of extortion in combination, in an effort to increase their chances of scoring a big payday. Starting in late 2019, the Maze group pioneered the “double extortion” trend, combining both ransomware and data exposure threats. The term “double extortion” refers to the use of two cyber extortion tactics in tandem, such as denial and exposure threats. This creates greater leverage for the adversary and can result in a larger payment from the victim.
Other groups such as RagnarLocker, Avaddon, and SunCrypt have combined DDoS tactics with traditional ransomware or data exposure threats.11,12 For example, in an October 2020 attack on a home appliances company, the SunCrypt gang launched a DDoS attack against the victim’s network after initial ransomware negotiations stalled. According to a leaked transcript, the criminals wrote: “We were in the process on the negotiations and you didn’t show up so further actions were taken.”13
11. Lawrence Abrams, “Another Ransomware Now Uses DDoS Attacks to Force Victims to Pay,” Bleeping Computer, January 24, 2021, www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/.
12. Sean Newman, “How Ransomware Is Teaming up with DDoS,” Infosecurity Magazine, June 18, 2021, www.infosecurity-magazine.com/opinions/ransomware-teaming-ddos/.
13. Newman, “How Ransomware Is Teaming up with DDoS.”
We will discuss the expansion of extortion tactics in more detail throughout Chapter 2.
1.3 Impacts of Modern Cyber Extortion
Cyber extortion attacks have the potential to cause severe damage to organizations. Their impacts may include operational disruption, financial loss, reputational damage, and litigation, as well as ripple effects for employees, customers, stakeholders, and the broader community.
In this section, we discuss common negative effects of cyber extortion attacks, setting the stage for discussions of response and mitigation throughout this book.
1.3.1 Operational Disruption
The short-term impacts of cyber extortion can include partial or complete disruption of normal operations. This is particularly the case when the adversary uses denial tactics, such as ransomware or DDoS attacks.
For example, Scripps Health, a California-based health system, was hit with a ransomware attack in April 2021 that disrupted access to electronic health records for nearly four weeks. During this time, many patients were diverted to other facilities, and non-urgent appointments were delayed.14 Later that summer, hackers affiliated with the REvil ransomware gang detonated ransomware at 1,500 organizations around the world, leveraging vulnerabilities in the popular Kaseya remote management software.15 As a result, the Swedish grocery chain, Coop, was forced to close hundreds of stores, causing food to spoil and leading to a significant revenue loss for the company.16
14. “147,000 Patients Affected by Scripps Health Ransomware Attack,” HIPAA Journal, June 3, 2021, www.hipaajournal.com/147000-patients-affected-by-scripps-health-ransomware-attack/.
15. Liam Tung, “Kaseya Ransomware Attack: 1,500 Companies Affected, Company Confirms,” ZDNet, July 6, 2021, www.zdnet.com/article/kaseya-ransomware-attack-1500-companies-affected-company-confirms/.
16. Lawrence Abrams, “Coop Supermarket Closes 500 Stores After Kaseya Ransomware Attack,” Bleeping Computer, July 3, 2021, www.bleepingcomputer.com/news/security/coop-supermarket-closes-500-stores-after-kaseya-ransomware-attack/.
In a recent survey, more than one-fourth of the organizations surveyed reported that they had been forced to close their organization at least temporarily following a ransomware attack,17 and 29% were forced to cut jobs, according to security company Cybereason.18 Downtime statistics vary widely, but in the authors’ experience, partial recovery typically comes within two to five days; resumption of normal operations takes two to four weeks.
17. Ransomware: The True Cost to Business (Cybereason, 2021), p. 14, www.cybereason.com/hubfs/dam/collateral/ebooks/Cybereason_Ransomware_Research_2021.pdf.
18. Ransomware: The True Cost to Business, p. 12.
The good news (if you could call it that) is that 96% of ransomware victims were able to get some of their data back, either by restoring it from backups, using an adversary-supplied decryptor, or through another means, according to a 2021 survey conducted by security vendor Sophos. However, an important caveat applies: Victims that paid the ransom were able to recover only 65% of their data, on average. Only a mere 8% of victims surveyed were able to restore all of their data.19 Permanent data loss can lead to errors and cause extra work for many years in the future.
19. Sophos, The State of Ransomware 2021, p. 11.
Definition: Decryptor
The term “decryptor” refers to software that is used to decrypt data that was encrypted during a ransomware incident. While this term is not yet in the dictionary (as of the time this book was written), it is commonly used by ransomware response professionals, and so we will use it throughout this book. Note that ransomware decryptors can be obtained from many different sources, including free decryptors from security vendors, experimental utilities created by government or law enforcement agencies, and as software purchased from the adversary in exchange for a ransom payment.
Ransomware attacks can even put businesses out of business. In 2019, U.S.-based healthcare provider Wood Ranch Medical closed its doors forever after a ransomware attack encrypted all their patient data. “Unfortunately, the damage to our computer system was such that we are unable to recover the data stored there and, with our backup system encrypted as well, we cannot rebuild our medical records,” wrote the practice in its final statement to patients. “We will be closing our practice and ceasing operations…”20
20. Wood Ranch Medical, “Wood Ranch Medical Notifies Patients of Ransomware Attack,” September 18, 2019, https://web.archive.org/web/20191229063121/https://www.woodranchmedical.com/.
A Word About “Ransomware”
The term “ransomware” originally referred to malicious software used to deny victims access to information resources, typically by encrypting files or devices. Over time, colloquial use of this term has broadened to include other types of cyber extortion, such as threats to publish data.
In this book, we will use the term “ransomware” specifically to refer to the malicious software used to deny access to information resources. In the broader sense, we will use the term “cyber extortion.”
1.3.2 Financial Loss
Cyber extortion can have a devastating impact on a victim’s financial state. Losses typically accrue because of short-term disruption to the victim’s revenue generation process, expenses related to the investigation and remediation costs, and the ransom payment itself. For example, the global shipping company Maersk reported total losses between $250 million and $300 million after its IT infrastructure was suddenly wiped out in the destructive NotPetya faux ransomware attacks of 2017. The NotPetya malware destroyed the hard drives of infected computers. Although it appeared to offer a recovery option in exchange for a ransom payment, in fact the files were unrecoverable.21
21. Mike McQuade, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” Wired, August 22, 2018, www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/.
In this section, we discuss three common causes of financial loss in cyber extortion attacks: revenue disruption, remediation costs, and ransom payments.
1.3.2.1 Revenue Disruption
Obviously, any operational interruptions can cause an immediate disruption in revenue generation. This is especially impactful for businesses that generate revenue daily (as opposed to nonprofit organizations, schools, and public entities that may be funded on an annual basis). Hospitals, retailers, professional services firms, transportation, and manufacturing companies are particularly hit hard by such disruptions. For example, Scripps Health reportedly lost $91.6 million of revenue as a result of its 2021 cyberattack, largely due to “volume reductions during May 2021 from emergency room diversions and postponement of elective surgeries.”22
22. Robert King, “May Cyberattack Cost Scripps Nearly $113M in Lost Revenue, More Costs,” Fierce Healthcare, August 11, 2021, www.fiercehealthcare.com/hospitals/may-cyber-attack-cost-scripps-nearly-113m-lost-revenue-more-costs.
Business interruption insurance can soften the blow to a victim’s wallet. Typically, this type of insurance kicks in after a waiting period (such as 24 hours), after which the insurer will cover lost revenue up to a set dollar amount. See Chapter 12 for more information on cyber insurance coverage.
1.3.2.2 Remediation Costs
The costs to remediate a ransomware attack can add up quickly. Depending on the recovery strategy, necessary expenses may include hardware purchases (such as new hard drives or desktops deployed to quickly replace infected ones), software licenses, outsourced IT support, security and forensics services, and more.
The City of Baltimore reportedly spent more than $18 million recovering from its 2019 Robbinhood ransomware attack—a figure that generated significant controversy, since the ransom demand was only a fraction of this cost (the equivalent of $76,000 in Bitcoin).23 A large percentage of the funds were originally earmarked for parks and recreation.24 Similarly, Scripps Health reportedly spent at least $21.1 million on investigation and recovery following its 2021 attack.25
23. Ian Duncan, “Baltimore Estimates Cost of Ransomware Attack at $18.2 Million as Government Begins to Restore Email Accounts,” The Baltimore Sun, May 29, 2019, www.baltimoresun.com/maryland/baltimore-city/bs-md-ci-ransomware-email-20190529-story.html.
24. Luke Broadwater, “Baltimore Transfers $6 Million to Pay for Ransomware Atttack; City Considers Insurance Against Hacks,” The Baltimore Sun, August 28, 2019, www.baltimoresun.com/politics/bs-md-ci-ransomware-expenses-20190828-njgznd7dsfaxbbaglnvnbkgjhe-story.html.
25. King, “May Cyberattack Cost Scripps Nearly $113M.”
In 2021, the costs to remediate a ransomware attack more than doubled compared with the previous year, costing on average $1.85 million, according to Sophos.26 The average cost of a ransomware attack when a data breach was also involved was $4.62 million, according to IBM’s 2021 Cost of a Breach report.
26. Sophos, The State of Ransomware 2021, p. 12.
1.3.2.3 Ransom Payments
Obviously, the cost of a ransom payment itself can dramatically impact a victim’s finances. The average ransom payment has increased enormously in just a few short years. Many ransom payments are never disclosed, so it’s impossible to know the full picture, but we can monitor trends based on information published by ransom negotiators, insurance companies, and cryptocurrency research firms.
The incident response firm Coveware reported an average ransom payment of $136,576 in the second quarter of 2021, based on an analysis of the cases in which it was involved in the payment process.27 While this amount was down from the high reported by Coveware in 2020, it was a dramatic increase compared with the reported average ransom payment of $36,295 in the second quarter of 2019, and a mere $6,733 at the end of 2018.28
27. Coveware, “Q2 Ransom Payment Amounts Decline as Ransomware Becomes a National Security Priority,” July 23, 2021, www.coveware.com/blog/2021/7/23/q2-ransom-payment-amounts-decline-as-ransomware-becomes-a-national-security-priority.
28. Coveware, “Ransomware Amounts Rise 3x in Q2 as Ryuk & Sodinokibi Spread,” July 16, 2019, www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread.
Cyber insurance firm Coalition reported an average ransom demand of $1,193,159 in the first half of 2021—an increase of 170% compared with the first half of 2020. (Note that a ransom demand is different than a ransom payment; adversaries often negotiate and agree to discounts of 50% or more, particularly when higher dollar amounts are involved.) Coalition noted that “Our data only accounts for incidents where the organization filed a claim and the losses were above the organization’s deductible,” further skewing the average losses to the higher side.29
29. Coalition, H1 2021: Cyber Insurance Claims Report, July 2021, pp. 11–13, https://info.coalitioninc.com/download-2021-h1-cyber-claims-report.html.
According to Chainalysis, a cryptocurrency research firm, the average ransom payment rose significantly—from $12,000 in the fourth quarter of 2019 to $54,000 in the first quarter of 2021.30 Their data is based on payments to known ransomware-linked wallet addresses.
30. Since the Chainalysis data is based on payments to known ransomware-linked wallet addresses, early reports tended to underestimate the actual value of ransomware payments. As more addresses are linked to known criminals over time, the value of known payments tends to rise. This analysis is also limited in that only certain types of cryptocurrency are traceable (the Chainalysis research includes Bitcoin, Bitcoin Cash, Ethereum, and Tether). More and more criminals are shifting to payments in Monero, because it is much more difficult to track.
The authors of this book can corroborate the trend toward higher ransom demands payments. When we first began handling cyber extortion attacks in 2016, ransom demands were typically a few thousand dollars. As adversaries increased their capabilities and reach, ransom demands ballooned. As we wrote this book in 2022, we were regularly seeing ransom demands that ranged from $750,000 to $5 million. Clearly, the landscape has changed.
Heads Up! Skewed Statistics
Throughout this book, we’ll share statistics related to cyber extortion. However, there are critical limitations to all existing studies on cyber extortion. In particular:
Underreporting: There is no universal law requiring victims to report cyber extortion attacks (and even if there was, some would still choose to quietly attempt to sweep the incident under the rug). In some cases, the adversary deliberately publicizes a cyber extortion event. At other times, the impact is significant enough that the event becomes widely known (such as ransomware attacks on hospitals). However, many cyber extortion attacks are handled discreetly, without disclosure, and these cases may simply not be included in published statistics.
Statistical bias: Many cyber extortion statistics are produced by security vendors, incident response firms, ransom negotiation specialists, and insurance companies. As a result, their sample set is limited to their own customers or customers of affiliates, and is not representative of a broad spectrum of cyber extortion victims. Trends reported may be a result of changes to the author’s business, and not a result of actual changes in the cyber extortion landscape. Confusingly, vendors often try to represent their reports as using a statistically valid sampling technique, and journalists will report their data as such.
As a result, cyber extortion statistics vary wildly and their accuracy is questionable. Savvy readers should take all reports and studies on cyber extortion with a grain (or perhaps a pile) of salt.
In this book, we will share statistics from the more reputable sources, and also endeavor to point out any obvious bias or limitations in these studies. We encourage readers to carefully consider the source of any cyber extortion statistics. There may be value in the information provided, but no report can fully capture the state of cyber extortion today.
Happily, there are indications that information quality and availability may improve in the future. Recently, lawmakers and regulators have enacted stronger and more standardized reporting for cyber extortion incidents, and for cybersecurity incidents more broadly. For example, the United States’ Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) established broad reporting requirements for “covered cybersecurity incidents” that occur within “critical infrastructure.” The U.S. government intends to analyze the data and publish reports and statistics regularly.31,32
31. Davis Wright Tremaine LLP, “The Cyber Incident Reporting for Critical Infrastructure Act of 2022: An Overview,” May 20, 2022, www.jdsupra.com/legalnews/the-cyber-incident-reporting-for-6977192.
32. Amendment to H.R. 2471, “An Act to Measure the Progress of Post-Disaster Recovery and Efforts to Address Corruption, Governance, Rule of Law, and Media Freedoms in Haiti,” March 9, 2020, pp. 2464–2519, www.congress.gov/117/bills/hr2471/BILLS-117hr2471eah.pdf.
1.3.3 Reputational Damage
Victims of cyber extortion face a loss of trust, public image, and overall reputation that may lead to increased financial loss and decreased business. According to Cybereason, 53% of victims surveyed suffered brand damage as a result of a ransomware attack.33 This outcome is especially likely to happen when the cyber extortion incident involves theft of sensitive data, which can result in permanent loss of privacy for the data subjects, who may be employees, customers, or patients.
33. Ransomware: The True Cost to Business, p. 9.
Criminals capitalize on the fear of reputational damage. For example, in a 2020 cyber extortion case handled by the authors, the Maze cartel emailed the victim’s leadership. Here is their threatening message:
First of all, we will sell the personal data of your employees and customers on the market, which will already bring us a profit. Then we will inform all your clients that their private information has been compromised. … But the biggest losses for you will be from the publication of data that has been downloaded from your servers. You will be sued by both your employees and your clients. After publishing on our news site, you will incur colossal reputational losses for your business. I think that many existing clients will refuse your services. In the future, finding new customers will be problematic, since it is unlikely that someone wants to provide their personal data to a company that cannot save them.34
34. Email written by the Maze ransomware gang, August 2020.
Ransomware attacks often don’t make the news, particularly in industries where the public isn’t directly impacted. However, today’s adversaries frequently take matters into their own hands, threatening to notify data subjects even if the victim organization does not, in an effort to leverage the power of shame and embarrassment.
Modern cyber extortionists routinely launch data leak portals on the dark web, which they use to publish stolen data. More and more, cyber extortion events are widely covered by media outlets, in part due to increasingly sophisticated public relations efforts launched by adversaries. The result is greater potential damage to the victims’ reputations, which empowers the adversaries.
1.3.4 Lawsuits
Lawsuits have become a routine occurrence following a cyber extortion attack. This is driven by several factors:
The dramatic increase in data exposure as part of cyber extortion cases. This increases publicity surrounding the crisis and can also trigger data breach notification laws, in addition to proactive cybersecurity regulations.
Increasing numbers of experienced cyber attorneys and regulators who understand relevant laws/regulations and have experience responding to data breaches, business interruption, and related “cyber” topics.
A proliferation of laws and regulations that specifically address data breaches, cyber extortion, and cybersecurity. Examples include Europe’s General Data Protection Regulation (GDPR), state-level breach notification laws in all 50 U.S. states, and industry-specific regulations such as the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Further adding to the risk are stipulations such as ransomware guidance released by the U.S. Department of Health and Human Services, which states that victims need to “presume” that a breach has occurred “[u]nless the covered entity or business associate can demonstrate that there is a ‘… low probability that the PHI [personal health information] has been compromised.’”35
35. “Fact Sheet: Ransomware and HIPAA,” U.S. Department of Health and Human Services, Office for Civil Rights, July 11, 2016, www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf.
Lawsuits may be filed by customers, patients, employees, vendors, shareholders, or any other party potentially harmed by the cyber extortion event. For example, Scripps Health experienced major disruptions to its operations and notified more than 147,000 patients that their personal information might have been stolen in its 2021 ransomware attack.36 In the aftermath, patients filed multiple class-action lawsuits alleging that the health system was negligent and failed to appropriately manage risk.
36. Heather Landi, “Before Attacking IT Systems, Hackers Stole Information from 147K Patients, Scripps Health Says,” Fierce Healthcare, June 3, 2021, www.fiercehealthcare.com/tech/before-attacking-it-systems-hackers-stole-information-from-147-000-patients-scripps-health.
In a growing trend, plaintiffs are citing harm beyond the potential for identity theft and breach of privacy. After Universal Health Service (UHS) was hit with a ransomware attack in September 2021, patient Stephen Motkowicz filed a lawsuit because “the data theft delayed his surgery, which caused his employer-provided insurance to lapse and required him to purchase alternative insurance at a higher premium.”37
37. Barry K. Graham, et al. v. Universal Health Service, Inc., Case 2:20-cv-05375-GAM, May 17, 2021, https://fingfx.thomsonreuters.com/gfx/legaldocs/bdwpkwqxqpm/HEALTH%20UHS%20DATA%20BREACH%20opinion.pdf.
Litigation, of course, can be expensive, time-consuming, and trigger negative media attention for years after a cyber extortion event.
Case Study: Ripple Effects
The impacts of (and potential damage from) a cyber extortion event can be far- reaching. As an example, in May 2021, Colonial Pipeline suffered a complete service outage across its entire infrastructure that was triggered by a ransomware attack by the DarkSide ransomware group.38 The pipeline transported 100 million gallons of fuel throughout the east coast of the United States every day, so an operational outage of any kind meant serious issues for millions of consumers and businesses.
38. Joe Panettieri, “Colonial Pipeline Cyberattack: Timeline and Ransomware Attack Recovery Details,” MSSP Alert, May 9, 2022, www.msspalert.com/cybersecurity-breaches-and-attacks/ransomware/colonial-pipeline-investigation/.
Colonial had backups of its systems, but the restoration of services was a slow process. The organization paid 75 Bitcoin (roughly $4.5 million at the time) to obtain a decryptor, but the decryptor utility was so slow that it was essentially useless. Operations began to come back online five days after the attack started, but it was much longer before full recovery was reached.
In the meantime, gas stations that relied on Colonial Pipeline ran out of fuel and were forced to shut down. EZ Mart, a gas station in North Carolina, was one of them. According to EZ Mart’s owner, Abeer Darwich, his gas station ran out of fuel on May 12. He called his distributor, Oliver’s Oil, which told him that he could not get more fuel delivered until the pipeline was flowing again. The gas station was not fully operational for ten days, which resulted in lost revenue and potential loss of customers on a long-term basis.
After the attack, EZ Mart filed a lawsuit seeking compensation for disruption to its business, which relied on the key upstream provider. Notably, its case was strengthened because criminals did not directly shut down the Colonial Pipeline. Rather, according to court documents, the pipeline operators “elected to shut down the pipeline in whole or part not because the threat actor had reached the operational systems, but because Defendant was not sure it could continue to accurately bill for the product moving through its Pipeline.”39
39. EZ Mart 1, LLC, on Behalf of Itself and All Others Similarly Situated, v. Colonial Pipeline Company, Case 1:21-cv-02522-MHC, June 21, 2021, p. 7, https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/coloniallawsuit.pdf.
Often, impacted customers and third parties have no recourse or way to obtain compensation outside of litigation. In the case of Colonial Pipeline, the operator reportedly “acknowledged its duty to those affected by the failure, but to date has failed to offer them any compensation or remedy.”40 Affected businesses like EZ Mart, which do not have a direct contractual relationship with Colonial Pipeline, may have little recourse outside a court of law.
40. EZ Mart 1, LLC, v. Colonial Pipeline Company, p. 7.
1.4 Victim Selection
Cyber extortion attacks may be opportunistic, targeted, or hybrid, as described in this section. Understanding the attack type can help you gauge the likelihood of advanced evasion tactics, evaluate the risk of further compromise, and predict the adversary’s response to specific negotiation strategies.
1.4.1 Opportunistic Attacks
In an opportunistic extortion attack, the adversary’s strategy is not crafted with a specific victim in mind. Rather, the adversary maximizes their return on investment by casting a wide net and compromising victims that individually require a relatively low investment of resources. Typically, adversaries leverage automated tools such as phishing toolkits that can distribute malicious emails en masse, credential stuffing tools, vulnerability scanning software or services, and more. (We will discuss these entry methods in greater detail in Section 3.2.)
Victims may be any organization unlucky enough to have a vulnerability in a perimeter device, or an employee who accidentally clicks on a link in a phishing email. Organizations with slim budgets for cybersecurity are at higher risk, since they may not have the resources to patch vulnerabilities as quickly, roll out multifactor authentication, or implement comprehensive prevention measures like those described in detail in Chapter 10.
In the following case study, a veterinary clinic was completely shut down because of an opportunistic ransomware attack—without any manual interaction from the adversary.
Case Study: Veterinary Clinic
At a small veterinary clinic in Colorado, a receptionist received a DHL shipment notification and clicked on the attachment. Little did she know that it was a phishing email. When she opened the attachment, a macro executed that downloaded the GandCrab ransomware loader.
The ransomware automatically spread throughout the network. It scraped passwords from the receptionist’s computer (including the Local Administrator password) and moved laterally to other systems. The ransomware software also took advantage of the Eternal Blue vulnerability, exploiting a weakness in SMB to gain access to the clinic’s main file server. It locked up all computers on the network, including servers and workstations. The clinic had no backups, but if they had, the ransomware would have automatically encrypted them, too.
At the time, GandCrab was one of the top ransomware strains globally, and owed its success in part due to its “ransomware as a service” syndication model. The cybercriminals behind it essentially rented out their software, enabling would-be extortionists around the world to access their sophisticated tools for a fee.
For each computer that was encrypted, the GandCrab software automatically created a web portal on the dark web. Victims could access the portal using a Tor browser to visit the link that was listed in the ransom note. Each computer had its own ransom note. Using the portal, victims could view the ransom amount, automatically upload a (small) sample file for test decryption, access a chat feature, and more.
The ransom demand at the veterinary clinic was set at $5,000 per computer. There were 14 computers, so the cost to recover everything was $70,000. The clinic opted to purchase the key for three computers—two servers and one workstation. Happily, they didn’t need to pay. Within days of the attack, the GandCrab group announced that they were “leaving for a well-deserved retirement,” and shortly thereafter, a security research firm released an effective decryption tool.
The veterinary clinic was clearly hit with an opportunistic attack. The authors of this book, who were engaged as the response team, preserved the DHL shipping phishing email that had acted as the initial malware delivery vector. It turned out there were thousands of reports of this phishing email in VirusTotal, a popular malware analysis and reporting website. This was clearly a large-scale campaign that had been indiscriminately blasted out to a very large number of email addresses.
In all likelihood, the receptionist received that phishing email because her address was already on a mass spam distribution list that was bought and sold on the dark web, or she may have been included in the “Contacts” list of another organization that had been recently hacked. The adversary that attacked the veterinary clinic may have also successfully extorted dozens, hundreds, or even thousands of other organizations.
1.4.2 Targeted Attacks
In a targeted attack, the adversary focuses on compromising a specific entity. Targeted cyber extortion can take on many forms, and typically involves significant investment by the adversary, such as extensive reconnaissance, resource gathering, malware customization, and other specialized activities.
Typically, adversaries target organizations that they perceive have enough revenue to pay their desired ransom demand. In addition, adversaries often target organizations that may be critically impacted by technology outages (such as hospitals, technology providers, or manufacturing companies) or hold highly confidential and/or regulated information (such as public-sector organizations, law firms, and professional services). This gives the adversary strong leverage to use during the extortion phase.
For example, Tesla was targeted41 in 2020 by a Russian cybercriminal gang that attempted to pay a Tesla employee to install malware for purposes of extortion. The criminals’ goal was to exfiltrate Tesla’s sensitive information and then extort the company for millions of dollars. In preparation, Russian agent Egor Igorevich Kriuschkov fostered a relationship with a Tesla employee using WhatsApp, and then flew to the United States to wine and dine him before making his pitch: install malware in Tesla’s environment in exchange for a large payment. According to Kriuschkov’s later indictment,42 the adversaries “had to pay US $250,000 for the malware, which would be written specifically for targeting [Tesla’s] computer network.” In addition, the adversaries planned to pay Kriuschkov $250,000 and the employee $1 million for their assistance.
41. Andy Greenberg, “A Tesla Employee Thwarted an Alleged Ransomware Plot,” Wired, August 27, 2020, www.wired.com/story/tesla-ransomware-insider-hack-attempt/.
42. United States of America v. Egor Igorevich Kriuchkov, Case 3:20-cr-00045, September 3, 2020, www.justice.gov/opa/press-release/file/1313656/download.
Although some adversaries deliberately target “big game,” this strategy has also led to high-profile news articles and law enforcement attention, which criminals perceive as a threat. After the swift U.S. response to the Colonial Pipeline oil supply attacks, a REvil affiliate cautioned, “You can hit the jackpot once, but provoke such a geopolitical conflict that you will be quickly found. It is better to quietly receive stable small sums from mid-sized companies.”43
43. “Russian Hacker Q&A: An Interview with REvil-Affiliated Ransomware Contractor,” Flashpoint Intel (blog), September 29, 2021, www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor.
1.4.3 Hybrid Attacks
Many cyber extortion attacks are a hybrid of opportunistic and targeted attacks. For example, an adversary might send out thousands of phishing emails using an exploit kit and wait for victims to click on attachments. As the list of victims grows, the adversary can choose to actively engage with those who have high revenues or in specific industries such as healthcare (which has strong privacy regulations and stringent uptime requirements).
A Word About “Initial Access Brokers”
The adversary who encrypts a network or exfiltrates data is not always the adversary who originally compromises the victim. “Initial access brokers” operate as a partner to cyber extortion groups and exist for the sole purpose of selling access to already compromised environments. Brokers may operate as intermediaries between the adversary responsible for compromise and the cyber extortionist. Alternatively, as in cases like the infamous Emotet44 group, they may operate as a separate cybercriminal organization.
44. “FBI, Partners Disarm Emotet Malware: Global Law Enforcement and Private Sector Take Down a Major Cyber Crime Tool,” Federal Bureau of Investigation, February 1, 2021, www.fbi.gov/news/stories/emotet-malware-disrupted-020121.
1.5 Scaling Up
Over time, adversaries became increasingly aware that victim environments were interconnected through the technology supply chain and recognized it as a way to impact more victims with less effort. Cyber extortionists began to leverage weaknesses in the global technology supply chain to extort victims en masse, which caused widespread damage. This included leveraging managed service providers, technology manufacturers, software vulnerabilities, and cloud providers.
1.5.1 Managed Service Providers
Managed service providers (MSPs) provide technical services, support, and products for their customers. An MSP can be a perfect conduit for cybercriminals, since by design it has access to a multitude of organizations, and frequently uses standardized remote management software to connect to and manage all of its clients’ systems. An adversary with access to the MSP network could potentially use these same tools to connect to all of the targets simultaneously, steal files, or spread ransomware.
For example, on August 19, 2019, 22 Texas towns45 were hit simultaneously with ransomware, one of the first large-scale attacks of its kind. The adversaries, who were said to be affiliated with the REvil ransomware syndicate,46 carried out their attack by first compromising a Texas technology services firm that provided services to all 22 towns. The ransomware disrupted the cities’ abilities to provide building, driver, and contractor licenses; issue birth and death certificates; accept utility payments; and more.
45. Bobby Allyn, “22 Texas Towns Hit with Ransomware Attack in “New Front” of Cyberassault,” NPR, August 20, 2019, www.npr.org/2019/08/20/752695554/23-texas-towns-hit-with-ransomware-attack-in-new-front-of-cyberassault.
46. Jake Bleiberg and Eric Tucker, “Texas Ransomware Attack Shows What Can Happen When Whole Towns Are Targeted,” USA Today, July 26, 2021, www.usatoday.com/story/tech/news/2021/07/26/texas-ransomware-attack-impact-cyberattack-cybersecurity-small-town-america/8090316002/.
The adversary demanded a “collective ransom” of $2.5 million in exchange for the decryptor.47 Despite the massive impact on their operations, the victims reportedly did not pay the ransom, and instead recovered most of their data from backups. By September 7, 2019, about half of the towns were back to normal operations, while the rest struggled to complete their recoveries.
47. Ionut Ilascu, “Hackers Want $2.5 Million Ransom for Texas Ransomware Attacks,” Bleeping Computer, August 21, 2019, www.bleepingcomputer.com/news/security/hackers-want-25-million-ransom-for-texas-ransomware-attacks/.
This type of entry vector was not new. As early as 2016, the Dark Overlord cyber extortion group conducted an attack on multiple healthcare clinics, which was later traced back to an “inadequately secured” file in the cloud that contained passwords for all of the vendor’s customer networks.48
48. “Quest Records LLC Breach Linked to TheDarkOverlord Hacks; More Entities Investigate If They’ve Been Hacked,” DataBreaches.net, August 15, 2016, www.databreaches.net/quest-records-llc-breach-linked-to-thedarkoverlord-hacks-more-entities-investigate-if-theyve-been-hacked/.
Over time, cyber extortionists discovered that many MSPs used identical passwords to manage all of their customer systems, and eschewed multifactor authentication, since it would have added complexity to their support processes. The criminals then ramped up their crime spree: At the end of August 2019,49 REvil repeated its attack and compromised an MSP, encrypting the files of approximately 400 dental clinics. In November 2019,50 the group encrypted files at 100 dental offices, by again compromising their MSP.
49. Brian Krebs, “Ransomware Bites Dental Data Backup Firm,” Krebs on Security, August 29, 2019, https://krebsonsecurity.com/2019/08/ransomware-bites-dental-data-backup-firm/.
50. Brian Krebs, “Ransomware at Colorado IT Provider Affects 100+ Dental Offices,” Krebs on Security, December 7, 2019, https://krebsonsecurity.com/2019/12/ransomware-at-colorado-it-provider-affects-100-dental-offices/.
Reputable MSPs quickly adapted, adopting multifactor authentication (if they hadn’t already) and more secure password generation and storage practices. Still, they remained a target, by virtue of their key role in the technology supply chain.
1.5.2 Technology Manufacturers
Cybercriminals have long known that by gaining access to technology manufacturers, they can distribute malware far and wide. This type of attack was famously used to deploy the destructive NotPetya faux ransomware, dubbed “the most devastating cyberattack in history” by Wired magazine, with estimated global damages of more than $10 billion.51
51. Andy Greenberg, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” Wired, August 22, 2018, www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/.
The NotPetya compromise began when cybercriminals gained access to an update server at a tax preparation software company, M.E.Doc, which was used by an estimated 80% of companies in Ukraine at the time.52 In April 2017, they installed a backdoor in the company’s tax preparation software, which was released to customers. Two more backdoored releases were deployed to customers in May and June. Finally, on June 27, the adversary modified the update server’s configuration and redirected customer traffic to an outside server, which was used to deploy NotPetya.
52. “Ukraine Cyber-attack: Software Firm MeDoc’s Servers Seized,” BBC News, July 4, 2017, www.bbc.com/news/technology-40497026.
As the malware detonated on victim machines, it spread rapidly to connected systems by leveraging the EternalBlue vulnerability and other methods. “To date, it was simply the fastest-propagating piece of malware we’ve ever seen,” stated Craig William, a spokesperson at Cisco Talos, which handled the investigation. “By the second you saw it, your data center was already gone.”53
53. Greenberg, “The Untold Story of NotPetya.”
Fast-forward to December 2020, when a customer of SolarWinds, a popular remote IT monitoring and management software, discovered a backdoor in their network, which they traced back to SolarWinds’ Orion software.54
54. William Turton and Kartikay Mehrotra, “FireEye Discovered SolarWinds Breach While Probing Own Hack,” Bloomberg, December 14, 2020, www.bloomberg.com/news/articles/2020-12-15/fireeye-stumbled-across-solarwinds-breach-while-probing-own-hack.
An investigation determined that the attackers inserted malicious code into a routine software update that SolarWinds pushed to its customers.55 The malware had been distributed in the SolarWinds product between March and June of 2020—meaning the adversaries had the opportunity to access customer systems for at least six months before they were detected. In all 18,000 SolarWinds customers (including Microsoft, Visa, Mastercard, Ford, Cisco, U.S. Secret Service, U.S. Department of Defense, and Office of the President of the United States, among many others56) had installed the infected update.
55. Dina Temple-Raston, “A ‘Worst Nightmare’ Cyberattack: The Untold Story of the SolarWinds Hack,” NPR, April 16, 2021, www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack.
56. Mia Jankowicz and Charles R. Davis, “These Big Firms and US Agencies All Use Software from the Company Breached in a Massive Hack Being Blamed on Russia,” Business Insider, December 15, 2020, www.businessinsider.com/list-of-companies-agencies-at-risk-after-solarwinds-hack-2020-12.
Fortunately, SolarWinds was not publicly linked to a wave of ransomware attacks. Nevertheless, it illustrated how even today, adversaries can use technology vendors to gain a persistent foothold within their customers’ environments, enabling widespread data theft and arbitrary deployment of malicious software—both common precursors of a cyber extortion attack. This tactic has the potential to facilitate cyber extortion on a mass scale in the future.
1.5.3 Software Vulnerabilities
Cyber extortionists have targeted software, using vulnerabilities in these products or the products themselves as a mass distribution vector. For example, on July 3, 2021—the day before a major national holiday in the United States—the REvil cartel executed what was, at the time, the largest single ransomware deployment in cybersecurity history.57 The adversary exploited multiple zero-day vulnerabilities in the Kaseya VSA on-premises remote monitoring and management system, used by MSPs around the world to remotely manage customer networks.
57. Associated Press, “Scale, Details of Massive Kaseya Ransomware Attack Emerge,” NPR, July 5, 2021, www.npr.org/2021/07/05/1013117515/scale-details-of-massive-kaseya-ransomware-attack-emerge.
By leveraging access to this software product, REvil was able to detonate its malicious software on more than 1,500 victim networks around the world (a total of more than 1 million individual devices, the group claimed). This included grocery stores, healthcare clinics, municipalities, and more. The criminals demanded $70 million to provide a decryptor for all of the victims. Eventually, the keys were released, reportedly due to an international law enforcement operation.58
58. Dan Goodin, “Up to 1,500 Businesses Infected in One of the Worst Ransomware Attacks Ever,” ARS Technica, July 6, 2021, https://arstechnica.com/gadgets/2021/07/up-to-1500-businesses-infected-in-one-of-the-worst-ransomware-attacks-ever/.
Similarly, the Microsoft zero-day Exchange vulnerabilities of 2021 led to a wave of ransomware attacks—and fast. A patch released on March 2, 2021, addressed four vulnerabilities discovered in on-premises instances of Exchange. Almost immediately, cybercriminals began leveraging these vulnerabilities to install ransomware.59 Similarly, in the aftermath of the Log4j widespread vulnerability announcement, extortionists such as Conti began exploiting vulnerable VMWare servers as an initial entry point.60
59. “Ransomware Is Targeting Vulnerable Microsoft Exchange Servers,” Malwarebytes Labs (blog), March 12, 2021, https://blog.malwarebytes.com/ransomware/2021/03/ransomware-is-targeting-vulnerable-microsoft-exchange-servers/.
60. Vitali Kremez and Yelisey Boguslavskiy, “Ransomware Advisory: Log4Shell Exploitation for Initial Access & Lateral Movement,” AdvIntel, December 17, 2021, www.advintel.io/post/ransomware-advisory-log4shell-exploitation-for-initial-access-lateral-movement.
In late 2021 and 2022, ransomware gangs such as Conti, BlackByte, and others began routinely exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.61,62,63 Although Microsoft had previously released a series of patches, many victims had not successfully installed them, leaving organizations around the world vulnerable to attack.
61. Lawrence Abrams, “Conti Ransomware Now Hacking Exchange Servers with ProxyShell Exploits,” Bleeping Computer, September 3, 2021, www.bleepingcomputer.com/news/security/conti-ransomware-now-hacking-exchange-servers-with-proxyshell-exploits/.
62. Bill Toulas, “Microsoft Exchange Servers Hacked to Deploy BlackByte Ransomware,” Bleeping Computer, December 1, 2021, www.bleepingcomputer.com/news/security/microsoft-exchange-servers-hacked-to-deploy-blackbyte-ransomware/.
63. Lindsey O’Donnell-Welch, “Vulnerable Microsoft Exchange Servers Hit with Babuk Ransomware,” Decipher, November 4, 2021, https://duo.com/decipher/attackers-infect-vulnerable-microsoft-exchange-servers-with-babuk-ransomware.
1.5.4 Cloud Providers
As organizations around the world shifted their technology infrastructure to the cloud, many had the unspoken expectation that cloud providers would be immune to compromise—a sentiment that cloud providers themselves encouraged.
Cyber attackers have since proved them wrong. Cloud providers, as a rule, invest heavily in securing their infrastructures, but adversaries (including cyber extortionists) have repeatedly found ways to sneak through the cracks. What’s more, due to cloud providers’ extreme uptime requirements and potential for storing large volumes of sensitive data, they are high-value targets.
For example, Blackbaud,64 a cloud provider whose software is used by nonprofit organizations, charitable foundations, universities, and other organizations, was hit with a ransomware attack in May 2020. The company had approximately 35,000 customers in more than 60 countries, and boasted millions of users.65 Blackbaud’s products included support for fundraising, marketing, analytics, and more—which meant their cloud platform was designed to store a vast range of sensitive information, including personal details, sensitive financial records, payment card numbers, and more.
64. Sergui Gatlan, “Blackbaud: Ransomware Gang Had Access to Banking Info and Passwords,” Bleeping Computer, September 30, 2020, www.bleepingcomputer.com/news/security/blackbaud-ransomware-gang-had-access-to-banking-info-and-passwords/.
65. Nicole McGougan, “Blackbaud Makes Good on Modern Cloud Promise,” Blackbaud Newsroom, April 26, 2016, https://web.archive.org/web/20210116124707/https://www.blackbaud.com/newsroom/article/2016/04/26/blackbaud-makes-good-on-modern-cloud-promise.
The criminals gained access to Blackbaud’s environment in February 2020, but did not detonate ransomware until May 2020. Blackbaud, in turn, did not notify customers until July—two months after the company detected the attack—when it released a statement notifying customers of a “security incident that recently occurred.” The cloud provider told customers that the company’s cybersecurity team had stopped a ransomware attack in progress, and stated that “the cybercriminal removed a copy of a subset of data from our self-hosted environment.” However, it assured customers that the stolen data did not include “credit card information, bank account information, or social security numbers.”66
66. “Security Incident,” Blackbaud Newsroom, updated September 29, 2020, https://web.archive.org/web/20210429203816/https://www.blackbaud.com/securityincident.
Blackbaud went on to state that it had paid the ransom, with the assurance that any stolen data subset would be deleted. It also asserted that they had “no reason to believe that any data … was or will be misused; or will be disseminated or otherwise made available publicly.”67
67. “Security Incident,” Blackbaud Newsroom.
The subsequent ripple effects were enormous. Hundreds—if not thousands—of Blackbaud’s customers launched investigations to assess the risk to their community’s data. In many cases, they determined that they were legally obligated to do so. For example, many healthcare clinics are regulated by HIPAA/HITECH, which states that “[a]n impermissible use or disclosure of protected health information is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment.”68 Cyber insurers grappled with the surge of investigations and claims.
68. “HITECH Breach Notification Interim Final Rule,” www.hhs.gov/hipaa/for-professionals/breach-notification/laws-regulations/final-rule-update/hitech/index.html.
On September 29, 2020, Blackbaud submitted a filing with the U.S. Securities and Exchange Commission (SEC) and disclosed that “further forensic investigation found that for some of the notified customers, the cybercriminal may have accessed some unencrypted fields intended for bank account information, social security numbers, usernames and/or passwords.”69 This new revelation further fanned the flames.
69. “Blackbaud, Inc.,” Securities and Exchange Commission, September 29, 2020, www.sec.gov/Archives/edgar/data/1280058/000128005820000044/blkb-20200929.htm.
In the months that followed, a wide range of organizations publicly announced that they were impacted—including the Boy Scouts, National Public Radio (NPR), the Bush Presidential Center, universities, nonprofit organizations, and more. Approximately 100 U.S. healthcare organizations publicly reported a data breach as a result of the Blackbaud attacks, affecting at least 12 million patients.70,71
70. Paul Bischoff, “Ransomware Attacks on US Healthcare Organizations Cost $20.8bn in 2020,” Comparitech (blog), March 10, 2021, www.comparitech.com/blog/information-security/ransomware-attacks-hospitals-data/#How_much_did_these_ransomware_attacks_cost_healthcare_organizations_in_2020.
71. This statistic may include duplicate entries, as it is a sum of reported data subjects submitted by each individual entity.
More than two dozen lawsuits were filed against Blackbaud, and customers that were victims of the breach were also sued by their members and patients.72 At the time of this writing, lawsuits are still ongoing.
72. “Rady Children’s Hospital Facing Class Action Lawsuit over Blackbaud Ransomware Attack,” HIPAA Journal, January 6, 2021, www.hipaajournal.com/rady-childrens-hospital-facing-class-action-lawsuit-over-blackbaud-ransomware-attack/.
The Blackbaud attack is a landmark case that illustrates how a cyber extortion attack on a single cloud provider can impact thousands of organizations and millions of individuals. Over time, cyber extortionists will likely evolve new ways to leverage cloud providers’ centralized platforms, and apply increasingly advanced extortion tactics that involve direct communication with customers.
Despite the flood of public notifications in the Blackbaud case, even more notable are the thousands of Blackbaud customers that did not report the breach to their own employees, clients, and customers, but were undoubtedly affected. While U.S.-based healthcare clinics may have been legally required to “presume” a breach had occurred, conduct a risk analysis, and report, organizations in other industries were not bound by such regulations. Many cash-strapped customers may have had insufficient resources to respond to Blackbaud’s notification, and simply ignored the issue.
As the cybersecurity industry and legal frameworks around the world continue to mature, expect more cloud customers to investigate and notify the public in the wake of cloud cyber extortion attacks.
1.6 Conclusion
Cyber extortion is an epidemic. In this chapter, we defined cyber extortion and then described the four types of cyber extortion that organizations may currently face. We learned that a cyber extortion attack has very real, potentially far-reaching impacts on the operations, financial well-being, and reputation of the organization experiencing it. Finally, we showed how adversaries can leverage weaknesses in the technology supply chain to launch cyber extortion attacks on a massive scale.
In the next chapter, we will trace the evolution of cyber extortion attacks, including key technological advancements that have enabled modern cyber extortion.
1.7 Your Turn!
Every cyber extortion incident is unique. The response team’s options and priorities will vary depending on the victim organization’s industry, size, and location, as well as the details of the incident itself.
Based on what you learned in this chapter, let’s think through the potential impact of a cyber extortion incident.
Step 1: Build Your Victim
Choose one characteristic from each of the three columns to describe your victim’s organization:
Industry | Size | Location |
|---|---|---|
Hospital | Large | Global |
Financial institution | Midsized | United States |
Manufacturer | Small | European Union |
Law firm |
| Australia |
University |
| India |
Cloud service provider |
| Country/location of your choice |
Organization of your choice |
|
|
Step 2: Choose Your Incident Scenario
Select from one of the following incident scenarios:
A | Ransomware strikes! All of the victim’s files have been locked up, including central data repositories, servers, and workstations. |
B | A well-known cyber extortion gang claims to have stolen all of the victim’s most sensitive data and threatens to release it unless the victim pays a very large ransom demand. The gang posts the victim’s name on their dark web leaks site, along with samples of supposedly stolen data. |
C | Double extortion! Both A and B occur at the same time. |
D | The victim is hit with a denial-of-service attack on its Internet-facing infrastructure that slows its access and services to a crawl. The adversary threatens to continue and even escalate the attack unless a ransom is paid. |
Step 3: Discussion Time
Your victim is experiencing a cyber extortion incident. Given what you know about the victim and the scenario, answer the following questions:
Which objective(s) of the CIA Triad does the cyber extortion attack threaten?
Which type of cyber extortion is your victim organization experiencing?
Describe the likely impacts that the cyber extortion incident may have on your victim organization in the following areas:
Operations
Finances
Reputation
Legal risk
The victim organization has researched typical ransom demands for the type of cyber extortion event it is experiencing and has found a very wide range, from $1,000 to $2.5 million. What is a reasonable explanation for this broad range of reported ransom demands?
The victim organization hears that hundreds of other organizations are currently experiencing a very similar cyber extortion attack. What is one possible explanation?