Full Report
Le processus de double-extorsion est désormais bien installé dans les pratiques des cybercriminels. Ils lancent une attaque, volent des données à leur victime, en chiffrent, déposent une mal-nommée note de rançon avec des instructions pour prendre langue avec eux. Passé un délai plus ou moins court selon les cybercriminels et les enseignes de rançongiciel, les assaillants publient une revendication sur leur site vitrine. Menace de divulgation des données volées à l'appui. Lorsqu'elle survient, la divulgation peut attendre entre quelques semaines et quelques mois, parfois sous l'effet des efforts fructueux d'un talentueux négociateur pour jouer la montre.
Analysis Summary
# Tool/Technique: Double-Extortion & Ransomware Data Leak Practices
## Overview
Double-extortion is a multi-stage cyberattack strategy where threat actors not only encrypt a victim's systems but also exfiltrate sensitive data beforehand. The technique pressures victims into paying by threatening to publish the stolen data on dedicated "leak sites" (sites vitrines). This summary analyzes the discrepancy between public claims of data theft (claims) and actual data disclosure (leaks) across major ransomware operations.
## Technical Details
- **Type**: Technique / Cybercrime Business Model
- **Platform**: Cross-platform (Windows, Linux/ESXi)
- **Capabilities**: Data exfiltration, psychological warfare, automated leak scheduling.
- **First Seen**: Circa 2019 (popularized by Maze), though the article focuses on 2024-2025 activity.
## MITRE ATT&CK Mapping
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
- **[TA0040 - Impact]**
- [T1486 - Data Encrypted for Impact]
- [T1657 - Financial Theft]
- **[TA0011 - Command and Control]**
- [T1102 - Web Service] (Use of onion leak sites)
## Functionality
### Core Capabilities
- **Multi-tiered Ransom**: Demanding payment for both the decryption key and the deletion of stolen data.
- **Proof of Life/Theft**: Providing file trees or samples to prove data access.
- **Public Shaming**: Listing victim names on Dark Web portals to damage reputation.
### Advanced Features
- **Selective Non-Disclosure**: Offering victims an option to pay specifically to prevent data leaks (observed with Akira).
- **Secondary Extortion**: Using stolen data to target a victim's technical partners or clients.
- **Negotiation Stalling**: Using skilled negotiators to delay leaks while attempting to reach a settlement.
## Indicators of Compromise
*Note: This article focuses on programmatic and behavioral patterns rather than specific malware samples.*
- **Network Indicators**:
- `akira[.]onion` (Defanged)
- `qilin[.]onion` (Defanged)
- `cl0p[.]onion` (Defanged)
- **Behavioral Indicators**:
- Mass data exfiltration prior to `Win32/Filecoder` activity.
- Deployment of "Ransom Notes" (e.g., `README-AS-AKIRA.txt`).
- Periodic deletion of claim posts after successful post-leak negotiations.
## Associated Threat Actors
- **Akira**: High volume of claims, but only ~37% result in data disclosure.
- **Qilin**: Highly active; frequently removes claims (29% removal rate) or suffers infrastructure failures.
- **Cl0p**: Known for massive exploitation (MOVEit/GoAnywhere); 85% of claims do not result in immediate disclosure.
- **INC Ransom / Lynx / Sinobi / Safepay**: Operationally disciplined with high disclosure rates (89%).
- **DragonForce**: Very high follow-through on threats (94% disclosure).
## Detection Methods
- **Behavioral Detection**: Monitoring for large-scale outbound data transfers to unauthorized domains or cloud storage (e.g., Mega.nz, Rclone activity).
- **Dark Web Monitoring**: Tracking mentions of organizational domains on threat actor leak sites.
- **Log Analysis**: Identifying credential access and lateral movement patterns that precede the "double-extortion" phase.
## Mitigation Strategies
- **Data Protection**: Implementation of Data Loss Prevention (DLP) to monitor and block unauthorized exfiltration.
- **Zero Trust Architecture**: Segmenting sensitive data to prevent mass collection by attackers.
- **Incident Response Planning**: Preparing for public relations management and regulatory notifications (GDPR/CNIL) even if encryption is prevented but data is stolen.
- **Immutable Backups**: Protecting against the encryption phase, though this does not mitigate the disclosure threat.
## Related Tools/Techniques
- **Ransomware-as-a-Service (RaaS)**: The business model underlying these groups.
- **Living-off-the-land (LotL)**: Using tools like `Rclone` or `FileZilla` for the exfiltration phase.
- **Triple Extortion**: Adding DDoS attacks or direct harassment of clients to the pressure tactics.