Fake extortionists target U.S. companies with threats of stolen data publication

A group of extortionists named “Midnight” has been using data breaches and ransomware incidents to threaten U.S. companies. The group demands payment, threatening to sell or publish allegedly stolen data if the victims do not comply with their demands. In some cases, the group also threatens victims with a distributed denial-of-service (DDoS) attack.

Since at least March 16, Midnight has been targeting U.S. companies, claiming to have stolen hundreds of gigabytes of important data. The group has also impersonated some ransomware and data extortion gangs in emails, including the Silent Ransom Group (SRG) and the Surtr ransomware group.

The fake emails are part of a larger trend, which has been observed by managed detection and response division at the Kroll corporate investigation and risk consulting firm since early November 2019. The attackers use the names of better-known cybercriminals in an attempt to intimidate and give legitimacy to their threat.

Kroll reported that, starting March 23, organizations began filing an increased number of reports for emails received under the Silent Ransom Group name. The company stated that this is a new wave of fake extortion attempts, and the trend is expected to continue indefinitely due to its cost-effectiveness.

Arete, another incident response company, confirmed Kroll’s observations about Midnight Group’s fraudulent emails impersonating Surtr and SRG. However, the company noted that Midnight targeted organizations that had previously been victims of a ransomware attack.

According to Arete, at least 15 of their current and previous clients received fake threats from the Midnight Group. It is unclear how victims are selected, but it is possible that the group obtains information from publicly available sources, such as data leak sites, social media, news reports, or company disclosures.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web