Compound Extortion: UnSafeLeaks

JUMPSEC have recently tracked a data leak site variant called UnSafeLeaks.

UnSafeLeaks’ tendency to target senior leadership and other prominent employees with malicious blog posts sets it apart from typical ransomware sites, which thus far have taken a more transactional approach to achieve purely financial objectives. Several organisations targeted by UnSafeLeaks have also been previously compromised by affiliated ransomware groups, suggesting the potential re-extortion of victims.

With these unique factors at play, UnSafeLeaks presents an emerging threat that has yet to be clearly defined. Terms like ‘double’, ‘triple’ and even ‘quadruple extortion’ have been coined to describe attacks where ransomware groups simultaneously exfiltrate sensitive data, use subsequent DDoS attacks, or notify victims’ clients and suppliers to intensify the pressure to pay.

However, UnSafeLeaks are not actively leveraging victims’ encrypted networks or disrupted operations to achieve their objectives. Perhaps more accurately described as compound extortion – organisations that have already fallen victim to ransomware now face unforeseen repercussions months after an initial attack, and to compound the situation, individual employees or senior leadership are being targeted in malicious campaigns of personal defamation.

Why UnSafeLeaks is different

Up to now data leak sites have served two primary functions:

Insult to injury

Many of UnSafeLeaks’ posts read more like the words of a schoolyard bully than a calculated ransomware group focused on profits, commenting on a prominent CEO’s divorce, implying evidence of sexually explicit images, referring to drug use by senior stakeholders, and drawing connections between corporate executives and prominent political figures.

Up to now, ransomware threat actors have generally presented themselves to victims as helpfully identifying a network vulnerability (much like a legitimate third-party security provider), adopting a transactional tone to persuade breached organisations that they will amicably part ways once a payment is received. UnSafeLeaks’ shift towards targeting an organisation’s senior leadership represents a significant change.

Who are UnSafeLeaks?

Upon analysis of targeted organisations, JUMPSEC have identified that the majority of victims targeted by UnSafeLeaks were compromised in ransomware attacks dating as far back as early 2021, predominantly by two groups – REvil (Sodinokibi) or BlackCat (ALPHV). The remaining target organisations were previously compromised but avoided publicity and have never featured on data leak sites, indicating they are now likely being re-extorted after paying a ransom.

To rewind for a moment, Russian based REvil were arguably the most notorious and impactful ransomware groups globally, claiming high-profile attacks on the Colonial Pipeline, IT provider Kaseya and Apple, amongst others, prior to a well-orchestrated public shutdown in 2021. Since then, numerous groups have been dubbed as REvil spin offs, most notably BlackCat (ALPHV) who have risen to prominence in 2022 and 2023 by targeting a number of high-profile organisations.

Both REvil and BlackCat are no strangers to innovating with novel extortion strategies. REvil pioneered a number of double and triple extortion tactics while BlackCat recently launched a search function to make it easier to find victims or even specific details on the clearnet (i.e not the darknet).

And in an ominously prophetic nod to upcoming extortion tactics in a 2021 interview prior their shut down, a REvil member stated:

“We call each target as well as their partners and journalists—the pressure increases significantly [i.e ‘triple extortion’]. I also think we will expand this tactic to persecution of the CEO and/or founder of the company. Personal OSINT, bullying. I think this will also be a very fun option. But victims need to understand that the more resources we spend before your ransom is paid—all this will be included in the cost of the service.”

Whoever the orchestrators, UnSafeLeaks are likely one of, or a combination of, the following:

UnSafeLeaks are not unequivocally the same individuals behind REvil, BlackCat or other affiliate threat actors. And, while these likely connections provide ample interest for speculation, identifying precisely who UnSafeLeaks are is not the crucial point here.

Undermining or enhancing ‘established’ ransomware?

UnSafeLeaks are re-purposing pre-hacked data, but at what cost to ransomware in the long run?

As ransomware groups rely on the flow of crypto payments from target organisations, often backed by their insurers, the more organisations who recognise that paying a ransom will not reliably keep data private, the less paying a ransom will be viewed as a feasible solution in the midst of a live attack. And there are already indications that ransomware groups could be having less success monetising attacks.

The recent LockBit vs Royal Mail saga saw leak deadlines pushed back and ransom negotiations, which lasted almost two months, ultimately leading to non-payment (similarly to BlackCat’s recent failed efforts).  Unsuccessful high-profile extortion efforts are terrible PR for ransomware and when you’re in the extortion business, maintaining a formidable public presence is vital.

With that in mind, reaffirming the depths that ransomware groups are willing to go via the cutthroat personal defamation of senior stakeholders may not only be a persuasive negotiation tactic but a necessary long-term strategy in terms of public perception.

Furthermore, insurers have tightened clauses to limit their exposure to cyber attacks making less funds available to victims. Attacker revenues have reportedly decreased for the first time (down 40% in 2022), and while fluctuating, the exponential growth of annual attack rates also appears to have lessened.

With ransomware threat actors accustomed to estimated profits of ~$663 million on average over the past three years, breaking the typical rules of engagement by re-extorting victims and getting increasingly personal may be a logical strategy for RaaS groups experiencing their first downturn in revenue.

If the ransomware economy is shrinking as reported, threat actors’ strategies may well shift from formerly ambitious attempts to build a sustainable extortion model to a more direct ‘smash and grab’ approach that utilises the existing data of old attacks, especially if threat actors perceive that business is drying up.

What this means for targeted organisations

As a senior stakeholder, CISO, or CEO evaluating the implications of personalised compound extortion attacks, the idea of having not only your business threatened but your reputation tarnished or personal data exposed may be a daunting prospect. The current ransomware landscape is evolving, but there are steps that individuals and organisations can take to mitigate the risk of exposure.

First and foremost, JUMPSEC advise that whenever possible organisations should avoid paying a ransom, as initial payment is tacit indication that the target is primed for further compromise. If the reported struggles of ransomware groups are to be believed (i.e, diminished growth of attack rates, lower profits, and less margin to leverage insurance) perhaps this realisation is finally gaining traction within the industry.

Whilst increasing organisational resilience through advanced Incident Response programs, at-risk individuals need to take greater personal accountability and implement proactive security measures. For example:

It is important to stress that UnSafeLeaks is not necessarily the next phase of ransomware. It may simply be an off shoot or a deviation away from typical ‘established’ RaaS groups’ activity observed thus far. However, JUMPSEC are not alone in documenting a recent trend towards increasingly personal attacks (for example recent reports on UNC3661 (Lapsus), UNC3944, and UNC3944).

It is therefore important to be aware that compound extortion can occur after an initial ransomware attack even if a ransom is paid, and to acknowledge the current trend towards highly personalised attacks on individual employees as a strategy which threat actors may continue to utilise.