New analysis of attacks shows threat actors that traditionally focus on stealing data are now utilizing extortion as their monetization strategy, converging tactics with ransomware attacks.
We’ve all become “comfortable” with the norm that ransomware gangs extort to make money and data breach gangs steal and sell the data. But a new cybercriminal gang identified as SnapMC by security researchers at the NCC Group appears to be blurring the threat tactic lines and could be the poster child for what’s to come.
According to NCC Group, SnapMC (named for their very fast attack patterns) gain access to and steal data from networks in under 30 minutes. Once data has been exfiltrated, the story changes and begins to look like a ransomware attack. The victim organization is notified via email of the data theft and an extortion begins – the victim has 24 hours to respond and 72 hours to negotiate. A list of stolen data is included and if the timeframes are not met, the data may be published with media outlets informed.
While this gang uses vulnerable Internet-facing devices as their initial attack vector, I suspect we’re going to see an entirely new set of services helping those experienced at data breaches to pivot their attack into an extortion scam, and plenty more phishing attack players getting into the game to provide the initial access to the data breach folks.
Here's how it works:
