Dati ransomware pubblicati in chiaro Piergiorgio Venuti

The data exfiltrated during a double extortion ransomware attack is not public. Let’s dispel a myth

Estimated reading time: 3 minutes

Introduction

Ransomware attacks are becoming more common and lucrative for cybercriminals. In particular, the “double extortion” variant involves not only encrypting the victim’s data, but also stealing and threatening to publish it online for ransom. It is commonly believed that stolen data is not actually disclosed publicly, but remains confined to the dark web. In reality, things are not like that.

What is the dark web

The dark web refers to that part of the internet whose contents are not indexed by standard search engines. To access the dark web you need to use specific browsers such as Tor, which make browsing anonymous by encrypting and routing traffic through multiple nodes. Thanks to the anonymity it guarantees, the dark web is often used for criminal activities, such as the sale of stolen data.

However, the dark web is not as dark and mysterious as it is believed. Software like Tor is free and easily accessible to everyone. As a result, even sensitive data of companies that have ended up on the dark web can easily be leaked, even publicly.

Cybergangs also often publish unencrypted

Contrary to common belief, many of the criminal organizations that manage ransomware attacks end up publishing the stolen data of the victims even publicly, as an additional tool to pressure to obtain the ransom payment.

The forums and sites used for these publications are often hosted on non-EU servers, where there are no legal consequences, and are easily accessible to anyone. For example, the Conti group, one of the most active in the ransomware world, regularly publishes exfiltrated data through its “Conti Leaks” site.

Even lesser-known ransomware groups end up posting stolen data samples on public forums, then posting the URL to the victim, to demonstrate that the threat of full disclosure is real.

These publications take place on sites accessible to anyone with an internet connection. It is not necessary to resort to the dark web to access the stolen data.

Because cybergangs publish data in the clear

There are mainly three reasons that drive ransomware operators to publish the stolen data also publicly, and not only on the dark web:

  • Increase pressure on the victim: Publishing a sample of sensitive data is a powerful coercion tool to pressure the victim into paying to avoid full disclosure.
  • Damage the image of the target: Cybergangs often aim to inflict as much damage as possible on the victims, as well as to obtain a ransom. The publication of the data damages the reputation of the affected organization.
  • Advertising for your services: Showing the leaked data serves as proof of the effective capabilities of the ransomware group, allowing you to attract more customers for future attacks.

A million dollar business

Selling stolen data has become an extremely lucrative business for cybercriminals, second only to ransomware. Recent reports estimate that revenues from the sale of stolen data alone in 2021 netted hackers over $2 billion.

Sensitive company data can be sold for tens of thousands of euros on the dark web. But free sample posting further increases the destructive impact of the attack.

Conclusion: prevention is better than cure

The possibility that the data stolen by a ransomware attack will be publicly disclosed, and not only on the dark web, is therefore concrete and should not be underestimated. The consequences of such a data breach can be extremely serious for a company, causing reputational damage, legal fines and loss of intellectual property.

It therefore becomes crucial to invest in prevention, adopting modern security solutions such as SOC (Security Operation Center) platforms that monitor the corporate network 24 hours a day to identify and block attacks before hackers can steal or encrypt sensitive data.

In addition, advanced threat intelligence services such as those provided by companies such as Secure Online Desktop allow you to monitor the dark web to identify any stolen company data that is being offered for sale, to take immediate action and limit the damage.

Useful links:

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • Monero 18.3.4 zero-day DoS vulnerability has been dropped publicly on social network. February 16, 2025
    Posted by upper.underflow via Fulldisclosure on Feb 16Hello, About an hour ago, a group appearing to be named WyRCV2 posted a note on the nostr social network, which can be found at the following link: https://primal.net/e/note1vzh0mj9rcxax9cgcdapupyxeehjprd68gd9kk9wrv939m8knulrs4780x7 Save, share, use. The paste link includes a list of nodes that the attacker has instructed to target, along […]
  • Netgear Router Administrative Web Interface Lacks Transport Encryption By Default February 16, 2025
    Posted by Ryan Delaney via Fulldisclosure on Feb 16
  • [CVE-2024-54756] GZDoom <= 4.13.1 Arbitrary Code Execution via Malicious ZScript February 16, 2025
    Posted by Gabriel Valachi via Fulldisclosure on Feb 15In GZDoom 4.13.1 and below, there is a vulnerability involving array sizes in ZScript, the game engine&apos;s primary scripting language. It is possible to dynamically allocate an array of 1073741823 dwords, permitting access to the rest of the heap from the start of the array and causing […]
  • Re: Text injection on https://www.google.com/sorry/index via ?q parameter (no XSS) February 16, 2025
    Posted by David Fifield on Feb 15Today at about 2025-02-13 19:00 I noticed the "≠" is back, but now the type 0x12 payload of the ?q query parameter gets formatted into the string representation of an IP address, rather than being copied almost verbatim into the page. If the payload length is 4 bytes, it […]
  • SEC Consult SA-20250211-0 :: Multiple vulnerabilities in Wattsense Bridge February 13, 2025
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Feb 12SEC Consult Vulnerability Lab Security Advisory < 20250211-0 > ======================================================================= title: Multiple vulnerabilities product: Wattsense - Wattsense Bridge vulnerable version: Wattsense Bridge * Hardware Revision: WSG-EU-SC-14-00, 20230801 * Firmware Revision: Wattsense (Wattsense minimal)...
  • APPLE-SA-02-10-2025-2 iPadOS 17.7.5 February 11, 2025
    Posted by Apple Product Security via Fulldisclosure on Feb 10APPLE-SA-02-10-2025-2 iPadOS 17.7.5 iPadOS 17.7.5 addresses the following issues. Information about the security content is also available at https://support.apple.com/122173. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, […]
  • APPLE-SA-02-10-2025-1 iOS 18.3.1 and iPadOS 18.3.1 February 11, 2025
    Posted by Apple Product Security via Fulldisclosure on Feb 10APPLE-SA-02-10-2025-1 iOS 18.3.1 and iPadOS 18.3.1 iOS 18.3.1 and iPadOS 18.3.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/122174. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accessibility Available for: iPhone XS […]
  • CVE-2024-55447: Access Control in Paxton Net2 software (update) February 11, 2025
    Posted by Jeroen Hermans via Fulldisclosure on Feb 10CloudAware Security Advisory CVE-2024-55447: Potential PII leak and incorrect access control in Paxton Net2 software ======================================================================== Summary ======================================================================== Insecure backend database in the Paxton Net2 software. Possible leaking of PII incorrect access control. Access cards can be cloned without physical access to the original...
  • ChatGPT AI finds "security concern" (XSS) in DeepSeek's code February 11, 2025
    Posted by Georgi Guninski on Feb 10Summary: On 2025-02-09 ChatGPT AI found "security concern" (XSS) in DeepSeek&apos;s AI python code. Background: Consider the simple coding question (Q): Write Python CGI which takes as an argument NAME and outputs: "Hello NAME". First page and results on google for "python CGI" return for me tutorials, which are […]
  • KL-001-2025-002: Checkmk NagVis Remote Code Execution February 4, 2025
    Posted by KoreLogic Disclosures via Fulldisclosure on Feb 04KL-001-2025-002: Checkmk NagVis Remote Code Execution Title: Checkmk NagVis Remote Code Execution Advisory ID: KL-001-2025-002 Publication Date: 2025-02-04 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2025-002.txt 1. Vulnerability Details      Affected Vendor: Checkmk      Affected Product: Checkmk/NagVis      Affected Version: Checkmk 2.3.0p2, NagVis 1.9.40      Platform: GNU/Linux      CWE...

Customers

Newsletter

{subscription_form_1}