Ransomware attacks — the scourge of businesses, schools, hospitals and other organizations — follow a familiar pattern. Shady criminals contact an organization, telling them their company or customer data has been breached, encrypted and/or exfiltrated. Pay us money, or we’ll publish your data.

In 2022, some 41% of victims paid, according to cyber-intelligence firm Coveware, rewarding the extortionists for their efforts. (Payment is declining every year, down from 76% in 2019.)

That knowledge no doubt inspired lazier, less-skillful scammers into action. In the wake of ransomware attacks comes a new threat, which is… fake ransomware attacks. It’s just like a real attack, except the attackers are bluffing — they really don’t have the goods or the access to carry out their threats.

The ransomware incident response company, Coveware, first identified the tactic in 2019. They call it “Phantom Incident Extortion.”

Experts say we’re currently undergoing a new wave of fake extortion attempts, and it’s likely to continue. Fake attacks have the advantage for scammers of being vastly faster and easier and therefore can be committed at a massive scale by scammers without skills. Because of the ease of this attack, cybersecurity experts expect it to exist indefinitely.

The “midnight” train to extortion

A group that calls itself “Midnight” falsely presents itself as an actual ransomware gang, such as Silent Ransom or Surtr, in order to extort money from American companies. They send emails to the victim organization, claiming to have stolen hundreds of gigabytes of data. The attackers demand payment in exchange for not publishing the data (which they don’t actually have). In some cases, they threaten a catastrophic DDoS attack as well.

“Midnight” isn’t alone. It’s just currently the best-documented example of how “Phantom Incident Extortion” plays out.

How fake extortion works

Because hacking is the hard part, fake extortionists replace breaching, encrypting and exfiltrating with shameless bluffing, which can be augmented by slights of hand. Here are some of the tactics:

1. Show real data.

Malicious actors get their hands on some personal data through means other than breaching and exfiltration. For example, careless social media posters can overshare information about their relationship with a company, or threat actors can present publicly available data as stolen. That limited information can stand in for all customer data, which the attacker falsely claims to have stolen for the purpose of publishing if the victim doesn’t pay.

2. Launch a DDoS attack.

DDoS attacks are easy to execute, and while it’s not easy to completely shut down an organization for long periods of time, a sudden rise in network traffic can accompany false claims that a network has been breached or is controlled by attackers. Or the threat of an easy DDoS attack may be added to increase the pressure to pay.

3. Use malware to simulate encryption.

Some fake extortionists are using old-fashioned phishing attacks to trick users into installing a malicious payload. One real-world example is that attackers offer free pornography, which can be viewed by clicking on a link to a fake porn website. Clicking on the link downloads four executables and a batch file that copies the executable to the Startup folder.

The malware finds all the data files it can and changes their names and extensions, then drops ransom notes saying that the victims have to pay or their files will never be unlocked.

The malware then attempts to delete all system drives except the C:\ drive.

The files aren’t actually encrypted. Only the filenames have been changed, and they’ll work fine if the names are changed back.

The benefit of this con is that, instead of the hard work of breaching, encrypting and communicating with the victim, it’s an easy set-it-and-forget-it proposition where the bluff and demand are both fully automated.

This attack generally aims at individual Windows user systems but is, in a way, worse than an actual ransomware attack. While only the filenames are changed, there’s no way to know the original file names. And when the attackers collect their ransom, they don’t follow up and restore the original filenames. They just take the money and run.

4. Demand a low ransom.

One tactic common with fake ransomware attacks is an absurdly low ransom — in some cases, mere hundreds of dollars (payable in Bitcoin).

The idea is that even if victims are pretty sure it’s a fake attack, the ransom amount is so low that they’ll pay in the spirit of “better safe than sorry.”

The perpetrators’ “business model” is to make ransoms cheap but make up the difference in volume.

How to deal with fake ransomware attacks

  1. Add knowledge about fake ransomware attacks to employee cybersecurity training. Emphasize anti-malware, anti-phishing and anti-social engineering understanding and techniques.
  2. Conduct regular backups so ransomware attacks, both real and fake, can be remedied should they occur.
  3. Maintain patches and security updates while using quality antivirus and anti-malware programs.
  4. Embrace solutions like Security Information and Event Management to speed up remediation and threat discovery.
  5. In the event of a ransomware attack, disconnect all connected devices and networks, then determine whether it’s real or fake. Look for tell-tale clues, such as low ransom demands, automated demands or files that are not really encrypted.

Understanding the growing scourge of fake extortion attempts means categorizing it not as a variant of ransomware but placing it into the buckets of malware, phishing and social engineering attacks. “Ransomware” is just the content of the con.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…