Greedy ransomware crews return for seconds after victims cough up first extortion payments
Summary
Ransomware gangs are increasingly targeting organizations that have already paid an initial ransom, demanding further payments. This secondary extortion tactic is prevalent even when victims have not had their files encrypted or restored after the first payment, according to Proofpoint.
IFF Assessment
This article highlights a concerning trend where ransomware actors are engaging in secondary extortion, indicating increased aggression and exploitation of victims.
Defender Context
Defenders should be aware that paying a ransom does not guarantee an end to extortion; attackers may return for additional payments. Organizations need robust incident response plans that account for the possibility of repeated demands and focus on preventing initial compromise and ensuring data backups.