Multiple Extortion: An Existential Threat

In today's increasingly vulnerable digital landscape, companies across the globe face unprecedented security challenges. Medium-sized organizations in particular aren’t always well prepared to defend against malicious actors. Multiple extortion stands out among these growing cyberthreats as a particularly dangerous risk that demands immediate attention. 

What is multiple extortion?

Executing a ransomware attack has traditionally involved infiltrating an organization’s IT systems, encrypting sensitive data, and demanding a ransom for its release. 

However, cybercriminals are increasingly expanding the scope and scale of their threats with the inclusion of a sophisticated three-pronged ransomware attack approach known as multiple extortion.

1. Encryption of sensitive information: The initial phase of the attack involves infecting IT systems with ransomware, rendering critical data inaccessible. This puts immense pressure on the organization to act swiftly to regain control of its assets.

2. Data exfiltration and threat of leakage: In addition to encrypting data, attackers extract sensitive information and threaten to leak it online. This poses a grave threat, as the exposure of sensitive company, personal, or customer information can lead to reputational damage, legal repercussions, and financial losses.

3. DDoS attack threat: To compound pressure on the targeted organization, cybercriminals may threaten to launch a distributed denial-of-service (DDoS) attack. This technique aims to overwhelm the organization’s network infrastructure, making its online services unavailable to legitimate users. DDoS attack threats amplify the organization’s urgency to comply with the attacker’s ransom demands, and may be used to distract the victim while the attacker executes other attack vectors.

Cyberattackers use multiple extortion because it’s a more compelling and holistic threat than simply encrypting data that victims can recover with a backup.

The severity of multiple extortion attacks across industries

Healthcare is particularly vulnerable

Healthcare institutions, among other important industries, are particularly vulnerable to multiple extortion attacks because of the sensitivity of patient healthcare data. In January 2023, the hacktivist group Killnet launched a DDoS attack against 14 medical centers across the United States. 

Attackers like Killnet know healthcare institutions rely on timely access to patient data and operational systems, making those victims more likely to comply with ransom demands under pressure. By stealing, encrypting, and threatening to expose protected patient data, the attackers put human lives at risk and force organizations to make quick decisions that may compromise patient care or violate privacy regulations. 

Cyberattacks against critical infrastructure

The Colonial Pipeline attack in May 2021 — the largest publicly disclosed cyberattack against critical infrastructure in the United States — is another prominent example of multiple extortion. A cybercriminal group known as DarkSide successfully infiltrated Colonial Pipeline to encrypt company systems and exfiltrate significant amounts of sensitive data: all to make a compelling case for their demanded ransom payment. 

The success of this attack led to widespread fuel shortages and highlighted the dire impacts of multiple extortion attacks on infrastructure and the economy, and even compelled President Biden to declare a nationwide state of emergency.

The threat to SMBs

It’s a common misconception that only large enterprises are targets for multiple extortion attacks. The reality is that small and medium-sized businesses typically lacking in robust security infrastructure are equally, if not more, vulnerable. In fact, cybercriminals increasingly target smaller organizations to exploit system vulnerabilities from weak security investments and encrypt and demand ransoms for their critical data. 

Medium-sized organizations, in particular, face a tough dilemma: pay the ransom and risk financial strain or refuse to comply and face potential data leaks along with potential operational disruptions. With potentially limited security resources and expertise, but the ability to pay a ransom, these organizations are more at risk of succumbing to pressure from multiple extortion attacks.

Safeguard employee access to resources with ZTNA

To mitigate risks associated with multiple extortion attacks, companies of all sizes and across industries should prioritize the protection of employee access to enterprise resources. Implementing end-to-end Zero Trust Network Access (ZTNA) can drastically reduce a company’s vulnerability (Figure 1). 

ZTNA provides identity-based access control that surpasses traditional firewall and VPN solutions that are seen as woefully inadequate for addressing today’s more threatening cyberattacks. ZTNA solutions take a “never trust, always verify” organizational safeguarding approach to ensure safe and granular access to resources based on user identity, device security posture, and contextual factors.