As Ransomware Gangs Shift To Data Extortion, Some Adopt A New Tactic: ‘Customer Service’

August 14, 2023 – Published on CRN

While traditional ransomware attacks have been all about maximizing disruption for victims, a growing wave of extortion attacks that don’t deploy encryption are seeking the opposite — as part of an effort to rebrand themselves almost as security advisors, cyberthreat experts told CRN.

At GuidePoint Security, No. 52 on CRN’s Solution Provider 500, the incident response team has encountered multiple cases where attackers have told their victims, “‘we did you the favor of not encrypting your environment,’” said Mark Lance, vice president for DFIR and threat intelligence at GuidePoint.

Such attackers will then provide a list of recommendations about how to better secure a breached victim’s environment, Lance said.

“For some groups, we’ve seen that they’ll send what they call a ‘security audit report,’” he said — a multi-page document providing details about how attackers gained initial access to an environment, accessed accounts and elevated user privileges.

Read More HERE.