Ransomware and Double Extortion: Why Backups Alone Don't Save You Anymore

Ransomware attacks have evolved far beyond simply locking files and demanding payment for their release. Today’s attackers use ransomware as a tool to gain leverage over organizations by quietly infiltrating systems, stealing sensitive data, and then threatening to expose that information unless their demands are met. This shift means that relying solely on backups to recover encrypted files no longer guarantees safety. Understanding how modern ransomware groups operate and preparing accordingly is critical to defending your organization.

How Ransomware Has Changed

Traditional ransomware attacks focused on quickly encrypting files and demanding payment to restore access. Now, attackers take a more calculated approach:

• They gain quiet access to networks through common entry points like stolen credentials, unpatched VPNs, or exposed remote access without multi-factor authentication (MFA).

• Instead of immediate chaos, they spend days or weeks mapping systems, escalating privileges, and copying sensitive data such as customer records, contracts, source code, and HR files.

• Only after securing this data do they trigger encryption.

• This leads to double extortion: victims must pay not only to decrypt files but also to prevent stolen data from being published.

  
  

Backups can restore encrypted files, but they cannot undo the damage caused by leaked secrets. This new reality means organizations must rethink their ransomware defenses beyond just backup strategies.

Common Entry Points for Attackers

Attackers often exploit everyday weaknesses to gain initial access:

• Phished credentials: Employees tricked into revealing passwords.

• Password reuse: Using the same password across multiple systems.

• Unpatched VPNs and internet-facing systems: Vulnerabilities that attackers exploit.

• Exposed remote access without MFA: Easy targets for unauthorized entry.

• Vendors with broad privileges: Third parties that have access to critical systems.

  
  

Many ransomware groups operate like a supply chain, with different teams specializing in access brokering, malware development, negotiation, and payment laundering. Understanding this structure helps defenders focus on breaking the right links to stop attacks early.

Building a Strong Defense Beyond Backups

Backups remain essential but are only one part of a comprehensive defense strategy. Here are key steps organizations should take:

• Maintain backups attackers cannot alter

- Keep three copies of backups

- Use two different types of media

- Store one copy offline or as immutable

- Regularly test restores to ensure reliability

• Require multi-factor authentication (MFA)

- Enforce MFA on email accounts, remote access, and administrative accounts to reduce risk from stolen credentials.

• Patch internet-facing systems quickly

- Apply security updates promptly to close vulnerabilities before attackers exploit them.

• Reduce administrative sprawl

- Limit the number of accounts with broad privileges so a single compromised account does not grant full control.

• Segment the network

- Divide networks into isolated zones to prevent attackers from moving freely and infecting all systems.

Responding When Ransomware Strikes

If an attack occurs despite your defenses, how you respond can make a significant difference:

• Isolate affected systems immediately to prevent spread.

• Preserve evidence for forensic analysis and potential law enforcement involvement.

• Bring in experienced responders who understand ransomware tactics and negotiation.

• Communicate with one voice internally and externally to avoid confusion.

  
  

Deciding whether to pay ransom demands depends on the specific situation. Strong preparation often removes the need to negotiate with attackers at all. The best negotiation is the one you never have to enter.

Why Small Organizations Are Still at Risk

Many small and medium-sized organizations believe they are too small to be targeted. This is a dangerous assumption. Attackers use automated tools and stolen credentials to find easy targets regardless of size. Antivirus software alone cannot stop attacks that rely on compromised credentials and lateral movement. Backups help with recovery but do not prevent data leaks or network infiltration.

Investing in access controls, network segmentation, and preparation buys options and resilience. These measures reduce the chances of a successful attack and limit damage if one occurs.