Who’s on the Phone? It’s the Ransomware Guys “Encouraging” You to Pay the Ransom!

Since August of this year, some ransomware attacks are being followed up by phone calls to increase pressure, promote the attack internally, and increase the chances of getting paid.

You should know by now that most ransomware families either are or are soon adopting the practice of exfiltrating data as part of an attack to be used as leverage to get the victim organization to pay up.

A new tactic involves calling the victim organization when the ransomware gang believe recovering the data may be attempted. It appears that a number of gangs are using the same call center to make the calls. The example message below is relatively consistent across ransomware families, and indicates that the gangs still have access to the victim network and are monitoring it:

“We are aware of a 3rd party IT company working on your network. We continue to monitor and know that you are installing SentinelOne antivirus on all your computers. But you should know that it will not help. If you want to stop wasting your time and recover your data this week, we recommend that you discuss this situation with us in the chat or the problems with your network will never end.”

I suspect this may also be strategically done to inform more employees than those affected in an attempt to get the news of a successful ransomware attack out to the public. That may be just the leverage the bad guys need to get the victim org to pay.

It’s already expected that ransomware attacks will increase in 2021, so putting precautionary measures in place, including Security Awareness Training is something you should be considering now before it’s your turn to answer the phone.