Analysis of new ransomware group Volcano Demon provides a detailed look into how and why calling victims ups the chances of ransomware payment.
Security researchers at Halcyon have uncovered a new ransomware threat group that initially follows traditional methods – harvesting admin credentials, data exfiltrated to a C2 server, logs cleared and data was encrypted using LukaLocker.
However, Volcano Demon attacks take a different direction in the extortion phase. The theft and encryption of the victim’s data aligns with traditional double extortion techniques. But instead of leaking to a site on the dark web, this group instead makes phone calls to “leadership and IT executives to extort and negotiate payment.”
According to a Recorded Future article on the same attack, it appears that the threat actors “call very frequently, almost daily in some cases.”
What’s interesting here is how the use of phone calls may actually increase the likelihood of payment. Think of how easy it is for a company to ignore a complaint email; why? Because there’s not person holding the recipient accountable.
Same could be said for Volcano Demon’s phone calls – rather than negotiating via email (which can be ignored by victim organization leadership), phone calls put the victim directly in touch with attackers, potentially negotiating some kind of terms that result in a payment to the attackers.
We might eventually see services offered to ransomware groups for handling ransom negotiations; we’ve seen the modularization of every other aspect of attacks, so why not “collections?”
All the more reason to render these attacks useless by stopping them in their tracks. Those relying on phishing as the initial access method can be thwarted by a layered email defense that includes security awareness training to ensure users participate in the organization’s defenses against malicious email and web content.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Here's how it works:
