What is Extortionware? How is It Different From Ransomware?

How does extortionware work?

In most cases, extortionware uses traditional malware to infiltrate a company’s digital resources. Once access is gained, the victim’s data is stolen and analyzed to identify information that can be used against them. Cybercriminals then contact the victim and threaten to release sensitive, embarrassing or illegal information to the public unless the victim meets the criminals’ demands. Typically, the demands are monetary in nature and involve the transfer of cryptocurrency.

How does ransomware work?

Ransomware is malware that locks and encrypts a victim’s digital resources, ranging from select data to the entire computer system, making it inaccessible until a ransom payment is made to the attacker. Ransomware is usually distributed through an infected attachment or malicious link.

Once ransomware has infected a user’s system, cybercriminals search for files containing sensitive data, such as personally identifiable information, financial data and health records. Users are then contacted by the attacker and made to pay a ransom to receive a decryption key to decrypt their files or to regain access to their system.

Comparing extortionware vs. ransomware

Extortionware might sound a bit like ransomware, and it is. Both ransomware and extortionware access and exfiltrate company data, usually with the intent of making money off the company from which it was stolen.

Unlike ransomware, which forces the business to either pay up or lose access to the stolen data, extortionists threaten to publicly release the collected information. This often pressures the business to comply, which increases the likelihood the victim will adhere to the extortion demands.

Ransomware variants, however, include extortionware features. Double extortion ransomware, for example, is when a malicious actor encrypts or locks access to systems and also threatens to release data stolen during the attack.

How risky is extortionware?

Most of the risks associated with ransomware can be mitigated by frequent offline data backups. With backups, businesses can easily restore their encrypted data.

Offline backups prove worthless when cybercriminals threaten to release data, rather than delete it. As such, the only way to combat extortionware is to prevent it from happening in the first place. This distinction makes extortionware a greater risk to businesses than ransomware.

Despite the risk, ransomware remains far more common than extortionware. The reason is simple: Hackers can automate the ransomware process, casting a wide victim net, while extortionware calls for a more time-consuming, targeted approach. Extra effort is required to review the stolen content to determine if any of the information can be used for extortion purposes. Thus, extortionists usually do their homework before attacking to ensure a target is worth the effort.

Ransomware remains the preferred attack method of cybercriminals because many organizations still don’t have proper offline backup procedures. However, once the lure and lucrativeness of ransomware dry up, expect a rapid shift to extortionware.

How to prevent an extortionware attack

Ransomware prevention best practices also apply to preventing extortionware. However, victims of ransomware attacks can often avoid paying the ransom by restoring the encrypted files from offline data backups.

With extortionware, prevention is the only way to keep bad actors from obtaining data and the only way an organization can remain unharmed. Extortion prevention measures include the following:

Editor’s note: This article was updated in May 2024 to improve the reader experience.

Andrew Froehlich is founder of InfraMomentum, an enterprise IT research and analyst firm, and president of West Gate Networks, an IT consulting company. He has been involved in enterprise IT for more than 20 years.