Quadruple Extortion  Ransomware

Quadruple extortion is based on a period of aggressive harassment of company-related actors, after the company has previously been subjected to a damaging attack. This is yet another technique with which cyber criminals seek to make as much profit as possible. 

In recent times, ransomware has become the predominant attack. Now, leading Spanish cyber security firm Entelgy Innotec Security analysed more than 7,000 cases of malware, including ransomware, Trojans, spyware across Spain over the course of 2022.

Their conclusion is that ransomware, phishing and DDoS attacks are the main cyber threats and that these exploits have become more effective, as a result of the specialization, sophistication and demand for cybercrime for hire, as a service. 

In addition, it is estimated that more than half of the companies that are attacked by ransomware agree to extortion. 

But how far can ransomware extortion go? The answer lies in quadruple extortion, which is already a reality.  
"Quadruple extortion is a technique used in ransomware cyberattacks whose objective is to maximise the monetisation capacity expected by the threat actor responsible for the campaign," explains Raquel Puebla, cyber intelligence analyst at Entelgy Innotec Security. 

With this new level of extortion, the aim is to ensure that the affected entity pays the ransom demanded by the attackers for the cyber attack, which is the ultimate goal of today's ransomware actors.

Therefore, "it is not understood as a cyber attack in itself, but as an additional layer to ransomware cyber attacks," Puebla sys. It is called quadruple extortion or fourth extortion stage because it usually takes place after three other stages that usually accompany these cyber attacks.

The Four Phases Of The Extortion Cycle

1.   Data encryption phase:   In most cases this involves a risk to the availability of the affected organisation's systems. In this case, the extortion consists of forcing the organisations to demand payment of the ransom so that they can regain access to the encrypted information. 

2.   Information leakage threat phase:   In this phase the attackers raise the level of extortion by threatening to publicly leak the information previously obtained during the compromise and encryption process, which in many cases results in the exposure of sensitive data or information that can entail all kinds of sanctions for the affected entity. This is known as Double Extortion. 

3.   Denial of Service (DDoS) campaign phase:   Which prevents users from accessing the affected organisation's resources, substantially increasing its losses by causing service unavailability. This model has come to be known as triple extortion and its use is very common in online commerce organizations. It prevents the achievement of sales. 

4.   Aggressive harassment phase:   Cyber criminals contact customers, employees and business partners of the affected organisation, as well as the media, to inform them that sensitive or confidential information associated with them has been compromised, for which they will first try to obtain data associated with users linked to the company from among the stolen information. 

"With this model, called quadruple extortion, the attackers intend that agents related to the organisation are the ones who promote that the entity agrees to pay extortion to remove the data breach that affects them," explains Puebla. 

The layers of extortion described work together to increase the losses of the organisation affected by the cyber attack, pressuring and wearing it down until it considers that the payment demanded by the cybercriminals is less costly than remedying the impact through the corresponding legal incident response channel. This is why cybercriminals are constantly trying to devise new extortion models to persuade their victims to make the demanded payment.

Early Detection 

There are several ways to prevent this type of cyber-attack and avoid irreversible damage. 

  • The detection of anomalous requests or connections from unknown or non-geolocated IP addresses in the employee's country or region of work are indications of suspicious activity, so it is highly recommended that all organisations establish monitoring activities on access to accounts, email addresses and corporate profiles.  
  • In addition, grammatical and spelling errors in e-mail messages that arrive in the user's mailbox, their origin from an unknown sender, and the inclusion of links to external websites or attachments can also be warning signs.
  • In the case of attachments, it may be advisable to scan them in anti-malware software before opening them, for example, and, if in doubt, it is always advisable not to open them. 
  • Other more obvious signs that could be observed at a later stage of the cyberattack could include unexpected changes in permissions, the appearance of blockages when accessing certain resources and even the appearance of a ransom note.

You Might Also Read: 

A New Approach To Cyber Security Helps Resist Extortion:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Severe Risks From Remote Access Exposure
US National Cyber Security Strategy Moves On »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

International Telecommunication Union (ITU)

International Telecommunication Union (ITU)

ITU is the United Nations specialized agency for information and communication technologies – ICTs. Areas of activity include cybersecurity.

Advisen

Advisen

Advisen is the leading provider of data, media, and technology solutions for the commercial property and casualty insurance market including cyber risk.

Akheros

Akheros

Akheros develops cybersecurity learning algorithms which anticipate, detect and prevent offensive and incongruous behaviors of M2M interactions.

NRI Secure Technologies

NRI Secure Technologies

NRI SecureTechnologies is a Cybersecurity group company of the Nomura Research Institute (NRI) and a global provider of next-generation Managed Security Services and Security Consulting.

Cyber Discovery

Cyber Discovery

Cyber Discovery, the UK Government's Cyber Schools Programme, is a learning programme designed to give young people the opportunity to learn the skills needed to enter the cyber security profession.

Telecommunications & Digital Government Regulatory Authority (TDRA) - UAE

Telecommunications & Digital Government Regulatory Authority (TDRA) - UAE

TDRA focuses on regulating the telecommunications sector and enabling government entities in the field of smart transformation. It is responsible for the overall digital infrastructure in the UAE.

Jerusalem Venture Partners (JVP)

Jerusalem Venture Partners (JVP)

JVP’s Center of Excellence in Be’er Sheva aims to identify, nurture and build the next wave of cyber security and big data companies to emerge out of Israel.

CAPSLOCK

CAPSLOCK

CAPSLOCK delivers career-changing cyber training to help adults re-skill. Learn online to become a cyber security professional and pay no tuition until you land a high-paying job.

Navisite

Navisite

Navisite is a combination of eight respected IT consulting and managed service providers that were brought together under the Navisite brand.

Narf Industries

Narf Industries

Narf Industries are a small group of reverse engineers, vulnerability researchers and tool developers that specialize in tailored solutions for government and large enterprises.

The CyberWire

The CyberWire

The CyberWire gets people up to speed on cyber quickly and keeps them a step ahead in a continually changing industry.

The Purple Guys

The Purple Guys

The Purple Guys offer Trouble-Free IT Support to businesses across the Central and Southern US. Safe and Secure, Rapid Response, Friendly Support that’s our Purple Promise.

IDVerse

IDVerse

IDVerse is focused on making user verification effortless through technology. We build intelligent tools that protect users from identity fraud while enabling a seamless user experience.

Coastline Cybersecurity

Coastline Cybersecurity

Coastline Cyber is a cybersecurity consulting firm dedicated to helping organizations strengthen their security posture by reducing risks, mitigating threats, and protecting against attacks.

SecZone

SecZone

SecZone is a Chinese enterprise with a mission to "Make It Secure." We are dedicated to driving software security innovation globally.

Jitterbit

Jitterbit

Jitterbit integrates critical business processes and enables application development to deliver the experiences and insights needed by enterprises of all sizes to accelerate their digital journey.