Over the past ten years, ransomware attacks have increased in frequency and sophistication. While exploits like social engineering and unpatched software may help with an initial breach, it's the coercive tactics that force victims to make rash and emotionally charged decisions, like paying the ransom.
Below are three of the most common tactics used by ransomware perpetrators to persuade victims into complying with their extortion demands.
1. Fear and humiliation
Fear is a potent emotion that threat actors use. When a victim's documents are encrypted, the message is usually clear: pay the ransom or lose your data forever. In addition to the fear of data loss, cybercriminals use the threat of humiliation to demand ransom in order to prevent the disclosure of sensitive information such as company files, financial data, or personal images.
Cybercriminals sometimes go one step further by threatening legal action, especially in highly regulated sectors like healthcare or finance: Pay the ransom, or we'll denounce you to the authorities. Due to the increased pressure, victims are compelled to take action out of fear about possible legal action.
2. Deadlines and ultimatums
Most ransomware demands include a tight deadline to intensify the pressure. Attackers usually give victims a deadline, like 48 hours, to comply, frequently along with a clear warning of the repercussions. Some ransomware programs show a countdown meter, which acts as a continual reminder that time is running out, to further exacerbate panic. Attackers may raise the stakes, such as making some of the stolen material publicly available, or double the ransom if the deadline is missed.
3. False hope and fake assurances
False promises are another tactic used by ransomware operators to trick victims into believing there is a possible solution. However, victims are merely coerced into complying by this hope. Attackers may provide a solution like a trial decryption tool to "prove" their solution works, a discount for speedy payment, or an extension on the payment deadline—tactics intended to strengthen the notion that paying the ransom would result in a complete recovery.
In reality, just 4% of individuals who pay are able to restore all their data. Furthermore, criminals frequently say that if the ransom is paid, the stolen data will be completely destroyed and the victim will be left alone. However, 78% of victims who pay report recurring attacks, proving that these assurances are nothing more than intentional deception.
Mitigation tips
The following are some best practices that can help organisations in handling these pressure tactics:
Preparedness: Ransomware attacks can happen to anyone. Employers must provide clear instructions and techniques for their employees to follow, as well as teach them how to respond and report in stressful situations while remaining calm and composed.
Avoiding impulsiveness: Avoid making decisions primarily based on emotional factors such as anxiousness or desperation. Evaluate all available information and investigate possible solutions and alternatives.
Not making a payment right away: Don't ever give in to the urge to pay. Speak with law enforcement, cybersecurity experts, and skilled ransomware negotiators, or get advice from cyber insurance companies. Investigate backups and other recovery options. Online decryptors may even be accessible for some ransomware strains.
