Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!

Your weekly dose of Seriously Risky Business news is written by Tom Uren and edited by Patrick Gray and Amberleigh Jack. This week's edition is sponsored by Island.

You can hear a podcast discussion of this newsletter by searching for "Risky Business News" in your podcatcher or subscribing via this RSS feed.

The cybercriminal ecosystem is increasingly focussing on data theft and extortion rather than locking up victims' files. That criminals have stumbled across a new lucrative business model is a bittersweet win in the fight against disruptive, encrypting ransomware. Data theft extortion isn't great, but it doesn't leave widespread chaos in its wake like ransomware can.

Silent Ransom, aka Luna Moth, is one group currently making big bucks from data theft extortion. Last week The Cyber Risk Insurer reported two law firms had paid substantial ransoms to the group this year: Goodwin Procter and WilmerHale, which paid USD$10 million and $USD18 million respectively. 

Silent Ransom has been targeting law firms since 2023. It historically used phishing and convinced victims to install legitimate remote access software which was then used to steal sensitive data. In the last year, however, they've brazenly sent people to compromise systems in person by posing as IT support staff.

Its data exfiltration process prioritises speed over completeness. Google's Threat Intelligence Group (GTIG) says the groups' entire attack process, from initial target contact to data theft and extortion, is often completed within a single day. With ransom payments in the millions, that works out to a pretty good hourly rate.

Another group that emerged in early 2026 was BlackFile, which now calls itself Redact. The group has also honed in on targeting similar organisations, but its data exfiltration is more comprehensive.

Redact gains initial access using sophisticated high-volume voice phishing attacks (vishing) to steal credentials from victim organisations. It then uses these credentials to steal data from OneDrive and Sharepoint. It also pivots out to other software-as-a-service applications. 

GTIG says BlackFile spent April and May this year targeting enterprises in the real estate, healthcare and insurance sectors. In June it had shifted its focus to large technology, transportation and hospitality organisations, particularly those with valuable intellectual property, source code or sensitive VIP client data. By July it had zeroed in on the financial and legal sectors including private equity firms, law firms and financial rating agencies. 

Just last week Reuters reported a series of attempted cyber attacks against Wall Street. These attacks, linked to BlackFile, targeted several major hedge funds and private equity firms. 

Based on Bitcoin transactions Google estimates BlackFile collected more than USD$10 million in payments from February to mid-May. The average ransom was USD$750,000. 

The cybercrime ecosystem really does seem to be migrating from encrypting ransomware to data theft extortion. Exact numbers vary, but a number of cyber security and risk firms have found data theft extortion rates are up while encrypting ransomware rates are down. 

This is good news and there are a number of potential reasons for this shift.

Victim organisations have gotten better at recovering from backups, for a start. And for cyber criminals, stealing data is less work than building and supporting encrypting malware. The threat of publishing stolen data is a very powerful motivator in certain verticals, too, and that threat can't be mitigated by maintaining good backups. 

Law firms, for example, are reputation-based businesses. The threat of confidential and attorney-client privileged information being leaked could easily be an existential threat to a firm. As Google puts it, law firms "may be highly motivated to resolve extortion situations quietly to protect their professional standing". They're not wrong!

We described this operational shift to data theft extortion as a win at the beginning of this article because it doesn't have the disruptive impact that ransomware often can. 

That's not to say that encrypting ransomware isn't still a problem. It hasn't gone away completely and we're still seeing some massive incidents from time to time. Last year's Jaguar Land Rover incident had a measurable impact on the UK economy and the 2024 UnitedHealth ransomware incident had serious effects on US healthcare services. 

With this in mind, governments should double down on countering encrypting ransomware to further incentivise criminals towards these lower-impact extortion campaigns. Disruption operations targeting the encryption ransomware gangs causing catastrophic results should be maintained. But the data extortion groups? Let them eat their multi-million dollar cake. At least for now.

Data theft extortion is the new hotness, and it may even be sucking the air out of encrypting ransomware. That's even more reason for governments to maintain the pressure on the ransomware ecosystem. The balloon is deflating. It's time to squeeze even harder. 

Secure by Design Deserves a Resurrection

Advances in AI models and a maturing understanding of how to harness them to write secure code mean it's the perfect time to reinvigorate CISA's stalled Secure by Design initiative.

The idea behind Secure by Design was simply to encourage companies to develop more secure products using carrots and sticks. The effort involved creating secure software development standards for companies to follow. The plan was to eventually introduce legislation that made companies liable if they continued to churn out insecure crapware. Companies that adhered to the standards would be fine, and those that didn't would suffer.

When we first wrote about Secure by Design three years ago we liked the idea but thought it would be a very long-term effort that would take at least a decade to implement. Secure software development was slow and arduous and even with clear guidance a lot of industry was always going to push back on the initiative.

President Donald Trump's Cyber Strategy was not keen on strengthening regulation and although the Secure by Design initiative wasn't killed outright, it has certainly withered on the vine. 

Things have since changed. The rise of very capable AI now means it is possible to take advantage of AI to produce more secure code from the get-go. It's just tokens, not real-world blood, sweat and tears.

Late last month Google described how it was using AI models in its development practices to both discover existing bugs in Chrome and prevent new ones from being introduced. This isn't as simple as telling Gemini to run off and write secure code with no mistakes. Google uses harnesses to run separate multi-agent workflows that find vulnerabilities, triage them, and then fix them. And in May this year Microsoft rolled out what it calls MDASH, its multi-model agentic vulnerability discovery harness. 

So the tech giants are already using AI to level-up their code quality, both through bug discovery and, perhaps more importantly, prevention.

We also think it might be time to revisit the original Secure by Design plan to make vendors at least somewhat liable for flaws in their products, too. The current status quo means vendors can absolve themselves of almost all liability via End User License Agreements (EULAs), a situation that probably made sense when expertise to discover vulnerabilities was rare. 

Now, however, it looks like the smart use of AI can be used to eliminate entire classes of security vulnerabilities. Why should software vendors remain completely unaccountable if improving the security of their products is more straightforward?

This Center for Strategic and International Studies report released last week contains useful suggestions for lawmakers when it comes to reshaping software liability. These include limiting liability for software producers that follow recognised secure development practices and drawing a distinction between open source maintainers and the for-profit companies that take advantage of their software. 

AI is changing software development, making it faster and cheaper. But it needs a little government push to also make it more secure.

Watch James Wilson and Tom Uren discuss this edition of the newsletter:

Three Reasons to Be Cheerful This Week:

1. Iranian attacks galvanise water security initiatives: Initiatives from lawmakers include suggesting that the tax code be amended to encourage investment in operational technology to better secure American critical infrastructure. A proposed Water Cyber Shield Act would also provide more money and authorise the Environmental Protection Agency to carry out cyber security assessments. The volunteer DEF CON Franklin project also announced that it will pay for cyber security firms to provide monitoring and protection for small water utilities. It has some initial seed funding but is seeking more grants and ultimately thinks it will need federal government money to scale up operations. 
2. FBI collaborate with China, Russia: Reuters reports that the FBI is collaborating with Chinese and Russian authorities to combat specific transnational crimes such as fentanyl trafficking, cyber scams and child sexual exploitation. These are serious problems that all countries involved have an interest in tackling. Hopefully collaboration will end up with some wins. At the same time, Russia and China are America's adversaries, so there are real counterintelligence concerns. Not to worry, we are sure FBI Director Kash Patel will mitigate these risks in a serious and sober way. 
3. Supply chain protection for open source maintainers: Open source supply chain security company Socket is offering free business plans to open source maintainers. Disclaimer: Socket is a Risky Business sponsor.   

Sponsor Section

In this Risky Business sponsor interview, Catalin Cimpanu talks with Michael Leland, Field CTO of Island, about the company's seamless expansion into SASE and enterprise AI.

Risky Biz Talks

You can find the audio edition of this newsletter and other fine podcasts and interviews in the Risky Biz News feed (RSS, iTunes or Spotify).  

In our last "Between Two Nerds" discussion Tom Uren and The Grugq talk about examples of cyber resistance and whether they achieve their goals.

Or watch it on YouTube!

From Risky Bulletin:

Russian hackers adopt the fake job interview tactics: One of Russia's elite military hacker groups is targeting system administrators and IT professionals in Ukraine using fake job interviews as a malware delivery vector.

Ukraine's CERT says the campaign began in May and is ongoing.

The attacks have been linked to UAC-0145, a sub-group of Sandworm, a veteran cyber unit inside Russia's GRU military intelligence agency.

Using fake job interviews as a malware delivery vector has been a popular tactic used by Iran and North Korea for several years. It's been used initially for cyber-espionage, but is now a popular entry vector for many of North Korea's financially-motivated operations, especially the ones targeting the cryptocurrency and Web3 developer community. China has also done this, but they usually use job interviews to recruit insiders, rather than hack their targets.

[more on Risky Bulletin]

Pwnie Awards 2026 winners: If there's one thing that has annoyed me as someone who doesn't attend the yearly BlackHat & DEFCON conferences, it's that I could never find out who won the Pwnie Awards for days and sometimes weeks after the event had concluded.But not this year, thanks to TechCrunch's Zack Whittaker, who spotted and shared a private link to one of the DEFCON live streams that broadcast the Pwnie Awards ceremony.

Let's just say curiosity got the better of me and I spent an hour extracting and sharing a list of this year's winners.

[more on Risky Bulletin]

Meta's AI joins Anthropic and OpenAI in the hacky-hacky: The UK's AI Security Institute has disclosed a security incident after two AI models it was evaluating performed actions the agency wasn't expecting and tried to hack real-world organizations.

The incident took place at the end of last month and the malicious actions were performed by Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol models, which were among the several models being tested at the time.

[more on Risky Bulletin]