Cloud Hosting

Ransomware attacks the scourge of businesses, schools, hospitals and other organizations follow a familiar pattern. Shady criminals contact an organization, telling them their company or customer data has been breached, encrypted and/or exfiltrated. Pay us money, or well publish your data.

In 2022, some 41% of victims paid, according to cyber-intelligence firm Coveware, rewarding the extortionists for their efforts. (Payment is declining every year, down from 76% in 2019.)

That knowledge no doubt inspired lazier, less-skillful scammers into action. In the wake of ransomware attacks comes a new threat, which is fake ransomware attacks. Its just like a real attack, except the attackers are bluffing they really dont have the goods or the access to carry out their threats.

The ransomware incident response company, Coveware, first identified the tactic in 2019. They call it Phantom Incident Extortion.

Experts say were currently undergoing a new wave of fake extortion attempts, and its likely to continue. Fake attacks have the advantage for scammers of being vastly faster and easier and therefore can be committed at a massive scale by scammers without skills. Because of the ease of this attack, cybersecurity experts expect it to exist indefinitely.

A group that calls itself Midnight falsely presents itself as an actual ransomware gang, such as Silent Ransom or Surtr, in order to extort money from American companies. They send emails to the victim organization, claiming to have stolen hundreds of gigabytes of data. The attackers demand payment in exchange for not publishing the data (which they dont actually have). In some cases, they threaten a catastrophic DDoS attack as well.

Midnight isnt alone. Its just currently the best-documented example of how Phantom Incident Extortion plays out.

Because hacking is the hard part, fake extortionists replace breaching, encrypting and exfiltrating with shameless bluffing, which can be augmented by slights of hand. Here are some of the tactics:

1. Show real data.

Malicious actors get their hands on some personal data through means other than breaching and exfiltration. For example, careless social media posters can overshare information about their relationship with a company, or threat actors can present publicly available data as stolen. That limited information can stand in for all customer data, which the attacker falsely claims to have stolen for the purpose of publishing if the victim doesnt pay.

2. Launch a DDoS attack.

DDoS attacks are easy to execute, and while its not easy to completely shut down an organization for long periods of time, a sudden rise in network traffic can accompany false claims that a network has been breached or is controlled by attackers. Or the threat of an easy DDoS attack may be added to increase the pressure to pay.

3. Use malware to simulate encryption.

Some fake extortionists are using old-fashioned phishing attacks to trick users into installing a malicious payload. One real-world example is that attackers offer free pornography, which can be viewed by clicking on a link to a fake porn website. Clicking on the link downloads four executables and a batch file that copies the executable to the Startup folder.

The malware finds all the data files it can and changes their names and extensions, then drops ransom notes saying that the victims have to pay or their files will never be unlocked.

The malware then attempts to delete all system drives except the C: drive.

The files arent actually encrypted. Only the filenames have been changed, and theyll work fine if the names are changed back.

The benefit of this con is that, instead of the hard work of breaching, encrypting and communicating with the victim, its an easy set-it-and-forget-it proposition where the bluff and demand are both fully automated.

This attack generally aims at individual Windows user systems but is, in a way, worse than an actual ransomware attack. While only the filenames are changed, theres no way to know the original file names. And when the attackers collect their ransom, they dont follow up and restore the original filenames. They just take the money and run.

4. Demand a low ransom.

One tactic common with fake ransomware attacks is an absurdly low ransom in some cases, mere hundreds of dollars (payable in Bitcoin).

The idea is that even if victims are pretty sure its a fake attack, the ransom amount is so low that theyll pay in the spirit of better safe than sorry.

The perpetrators business model is to make ransoms cheap but make up the difference in volume.

Understanding the growing scourge of fake extortion attempts means categorizing it not as a variant of ransomware but placing it into the buckets of malware, phishing and social engineering attacks. Ransomware is just the content of the con.

Continue Reading

The rest is here:
Spot Fake Extortion Attacks Without Wasting Time and Money - Security Intelligence