Ransomware and Data Extortion

Introduction

Ransomware is a major threat to businesses and organizations of all kinds. Ransomware and data extortion attacks are not only disruptive to business operations but also costly to resolve. They spur regulatory actions and civil litigation, including class action lawsuits against victim organizations, and more recently have even resulted in criminal charges being lodged against company officers.

Cybercriminals and hostile nation-state entities are extorting large sums from businesses and other organizations of all sizes across every industry vertical. They’ve been conducting such financially motivated cybercrimes for years now, continually refining and improving their exploitation techniques and encryption payloads. And even if a victim organization pays a ransom, there’s no guarantee that it will actually get its data decrypted, nor is there a guarantee that its data won’t be publicly exposed. Often, attackers don’t reciprocate a ransom payment with the promised action. After all, they’re criminals—they don’t have to follow any rules but their own.

The quarterly “Halcyon Power Rankings: Ransomware Malicious Quartile” report details the most prolific ransomware groups. In the fourth quarter of 2023, these included ransomware and data extortion groups like LockBit, Play, BlackCat/ALPHV, BlackBasta, Cl0p, Medusa, Cactus, Akira, and more. While authorities have been making scattered arrests here and there, they largely have failed to stem the tide of attacks. When one ...