What Is Cyber Extortion?

Cyber extortion is a category of cybercrime that involves digitally threatening or coercing someone to do something against their will. Cyber extortion typically disables an organization’s operations or exposes an entity’s valuable assets such as confidential data, intellectual property or infrastructure systems. A cybercriminal will then threaten organizations or individuals to pay a ransom to prevent further cyber attacks or regain access to their sensitive files or operations. The ransom is typically either money or access to other sensitive information.

Continue reading to learn more about cyber extortion, how it works, the common methods of cyber extortion and how to protect your organization from cyber extortion.

Cyber Extortion vs Ransomware: What’s the Difference?

Although cyber extortion and ransomware are often used interchangeably, they are different from each other while still holding a connection.

Cyber extortion is a broad form of cybercrime in which cybercriminals digitally blackmail organizations or individuals to get what they want. Cybercriminals can threaten to leak data, launch cyber attacks, disable operations, prevent users from accessing data or destroy stolen data unless the victim pays some form of a ransom. Cyber extortion uses a variety of methods such as doxxing, DDoS attacks and ransomware.

Ransomware is a type of malware and a common method of cyber extortion. It is often installed on a user’s device via phishing attacks or exploit kits. Ransomware prevents users from accessing their sensitive data and promises to return access after the victim pays a ransom.

Ransomware is a tool that cybercriminals can use to commit cyber extortion. All ransomware attacks are considered a form of cyber extortion, but not all cyber extortion incidents involve ransomware. 

How Does Cyber Extortion Work?

Cyber extortion works by first identifying the security vulnerabilities of an individual’s devices or an organization’s systems and exploiting them to gain unauthorized access. Once the cybercriminal gains unauthorized access, they access as many devices as possible, disable systems and steal as much data as they can. The cybercriminal then threatens that the organization or individual must pay a ransom to regain access to sensitive data, restore systems or prevent further cyber attacks.

The five steps of cyber extortion include:

1. Infiltration: Cybercriminals gain unauthorized access by compromising a victim’s network, system, device, data or server. Cybercriminals execute infiltration using a variety of techniques, such as phishing or exploit kits, to identify security vulnerabilities and gain unauthorized access.
2. Execution: When the cybercriminal has infiltrated the organization’s systems, the cybercriminal will prepare for the cyber extortion or launch a cyber attack. They often install malware that steals data, disables systems or infects as many devices as possible.
3. Extortion: Cybercriminals will then make their presence known to their victims by threatening them and ordering them to pay a ransom. If the victim does not pay the ransom, the cybercriminal will launch a cyber attack, leak or destroy stolen data or prevent them from regaining access to compromised data or systems.
4. Payout: If the victim pays the ransom, cybercriminals should return access to an individual or organization’s valuable assets or restore their systems. However, this is not always guaranteed as cybercriminals can, and often, refuse to keep their end of the bargain. 
5. Repeat: After a cyber extortion incident, cybercriminals will keep track of previous victims to retarget them for future cyber attacks. Since the victims have already shown that they have security vulnerabilities and are willing to pay a ransom, cybercriminals try to steal more data and money from them.

Common Methods of Cyber Extortion

Cyber extortion is a broad category of cybercrime that uses a variety of methods to threaten individuals and organizations into giving cybercriminals what they want. Here are the common methods of cyber extortion that cybercriminals use.

Ransomware

Ransomware is a type of malware that prevents users from accessing their sensitive data. When ransomware is installed on a user’s device, it locks users out by encrypting their files or devices. Cybercriminals will then contact the victim promising to return their access after they pay a ransom. However, cybercriminals may not fulfill their promise to give back the encrypted data after the ransom is paid and can sell it on the dark web or further extort their victims for an even higher ransom.

DDoS attack

A Distributed Denial-of-Service (DDoS) attack is a type of cyber attack that disrupts the normal traffic of a targeted server. Cybercriminals use a network of compromised computers and other IoT devices known as a botnet to overwhelm and flood a server with internet traffic. The flood of internet traffic causes the server to slow down or crash. Cybercriminals threaten organizations by demanding payment to stop the DDoS attack or prevent the attack from happening in the first place.

Data breach extortion

A data breach is when a cybercriminal steals information after bypassing the security measures of an organization. Cybercriminals bypass security measures by exploiting security vulnerabilities. After stealing the sensitive data, cybercriminals threaten organizations to leak the stolen data unless they pay a ransom.

Doxxing

Doxxing is when a threat actor publishes Personally Identifiable Information (PII) about their target online. The threat actor can publish information online such as the target’s home address, credit or debit card numbers and any other sensitive information. 

Doxxing requires threat actors to gather as much information about the target as possible through cyber attacks or information shared publicly, such as on social media. Once the information has been collected, cybercriminals can threaten to dox victims in exchange for money or access to other sensitive information.

How To Stay Protected Against Cyber Extortion

Cyber extortion can result in the loss of sensitive information, disabled operations and large financial losses. To stay protected against a cyber extortion incident and mitigate its effects, organizations need to practice the following.

Create an incident response plan

An incident response plan assigns responsibilities and lists procedures to follow in the event of a security breach. It allows organizations to handle cybersecurity incidents by identifying cyber attacks, remedying the damage from cyber attacks and preventing them from happening in the future. With an incident response plan, organizations can prepare for cyber extortion and mitigate its effects.

Implement least privilege access

Organizations should implement least privilege access to prevent cybercriminals from gaining access to sensitive data. The principle of least privilege is a cybersecurity concept that gives users just enough access to sensitive data to do their jobs and no more. It ensures that only authorized users have access to sensitive data. By implementing least privilege access, organizations can reduce their attack surface, minimize insider threats and prevent cybercriminals from moving laterally within their network. 

Educate employees about cybersecurity best practices

Organizations need to educate their employees about cybersecurity best practices to prevent cybercriminals from gaining access to sensitive data and using it to extort the organization.

Cybercriminals can exploit weak login credentials to gain access to an organization’s systems. Employees should be using strong and unique passwords to protect their accounts. Using strong and unique passwords that are both equally long and complex makes it difficult for cybercriminals to crack them and compromise multiple accounts.

Employees should also enable MFA to protect their accounts. Multi-Factor Authentication (MFA) is a security measure that requires an extra authentication step to gain access to accounts. With MFA, users add an extra layer of security to their accounts by requiring additional forms of identification. MFA ensures that only authorized users have access to their accounts.

Employees also need to be educated about cyber attacks to recognize them and avoid falling victim to them. Cybercriminals will often use social engineering attacks to trick employees into giving them access to sensitive information. Employees should avoid clicking on suspicious attachments or links to avoid social engineering attacks.

Keep software up to date

Cybercriminals can exploit security vulnerabilities found within outdated software to gain unauthorized access to accounts, devices or a network. However, software updates patch these security vulnerabilities. By keeping their software up to date, organizations can prevent cybercriminals from exploiting security flaws and add security features that better protect them.

Regularly back up data

Organizations and individuals can lose access to their data due to cyber attacks or damaged hardware. To always maintain access to data, individuals and organizations should regularly back it up with a cloud-based service or on a physical external hard drive. Having a backup of their data can prevent you or your organization from having to pay a ransom as a result of a cyber extortion incident.

Use antivirus software

Cyber extortion often requires the use of malware to steal sensitive data. Using high-end antivirus software can help prevent cybercriminals from stealing data. Antivirus software is a program that prevents, detects and removes known malware from devices. With antivirus software, individuals and organizations can detect and remove incoming malware from infecting their systems. 

Invest in cyber insurance

Cyber insurance is a specialized insurance policy created to protect businesses from losses due to cyber attacks. It covers the cost of notifying an organization’s customers of a security breach, restoring compromised identities of customers, and repairing damaged systems and data. Cyber insurance also connects organizations with third-party experts to aid with attack recovery.

However, cyber insurance will not cover prior security breaches or attacks caused by human error, inadequate security measures and preexisting security vulnerabilities. Although cyber insurance can help remedy the damage of cyber attacks, organizations need to secure their data and take the necessary precautions to prevent cyber attacks.

Use Keeper® To Stay Protected From Cyber Extortion

Cyber extortion can be difficult to deal with and leave damaging effects such as financial loss and reputational damage. Organizations need to secure their data and prevent cyber attacks from infiltrating their systems. The best way to prevent cyber extortion incidents is by investing in a PAM solution.

Privileged Access Management (PAM) refers to securing and managing access to highly sensitive data and systems. A PAM solution can help organizations implement least privilege access and ensure their sensitive data is secure. With a PAM solution, organizations have complete visibility into their networks, applications, servers, devices and employee password practices. 

KeeperPAM™ is a privileged access management solution that helps organizations prevent cyber extortion incidents from happening. It combines Keeper Enterprise Password Manager (EPM), Keeper Secrets Manager® (KSM) and Keeper Connection Manager® (KCM), allowing organizations to easily manage employee passwords, secrets and remote access. 

Request a demo of KeeperPAM to secure your organization’s sensitive data and protect it from cyber extortion incidents.