November 29, 2022

Volume XII, Number 333

Advertisement

November 28, 2022

Subscribe to Latest Legal News and Analysis
Advertisement

Hackers Experimenting with Deploying Destructive Malware

It’s a cold, hard fact that hackers don’t really care about their victims or their victims’ data or business. They are greedy, evil human beings that just want the money.

The newest trend for hackers is to develop and launch cyber-attacks that deploy destructive malware. This means that when a threat actor infiltrates a business’ system, it exfiltrates the data, and in the process deploys destructive malware that destroys the victim’s data if the ransom isn’t paid. The North Korean hackers used this type of malware during the attack on Sony years ago.

Threat actors are motivated by money. First, they deploy ransomware that encrypts files so the victim has no access to its data unless it pays for the encryption key. Security professionals understand that backing up data to recover it in the event of an attack can minimize the damage and a company could recover its data without paying the ransom.

Then the threat actors figured out that exfiltrating the data and threatening to publish the data on a shame website (a double extortion attack) gave the victim another reason to pay the ransom. Many companies refuse to pay the ransom in a double extortion situation, preferring to face the consequences.

Since companies are refusing to pay in cases of double extortion attacks, the threat actors are now developing destructive code that will corrupt the data or entire servers of the victim in the event the victim refuses to pay the ransom.

According to ZDNet, cybersecurity researchers at Cyderes and Stairwell have found that

at least one ransomware group is testing “data destruction” attacks. This would be dangerous for ransomware victims because while it’s often possible to retrieve encrypted files without paying a ransom, the threat of servers being completely corrupted if extortion demands aren’t met could push more victims towards giving in.

The suspected ransomware group is BlackCat, which might be a rebrand of BlackMatter, “which in turn was a rebrand of Darkside, the ransomware operation behind the Colonial Pipeline attack.”

Sadly, the researchers predict that the prevalence of data exfiltration and destruction will only increase.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XII, Number 272
Advertisement
Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement
Advertisement