The kill chain for double extortion ransomware is slightly different from that of typical ransomware. Of course, with double extortion, there are two separate methods of attack that take place within the single perpetration. Here is the kill chain:
Initial access: In this phase, the attacker is able to break into a user’s or organizations’ systems by using one of the methods listed above.
Network recon and lateral movement: The bad actor surveys the security landscape to see where they may be detected. Once they have free rein across resources, the attacker moves throughout different parts of the network.
Data exfiltration (extortion tactic #1): In the first step of double extortion, data is removed from the device, but not yet held for ransom. To that end, the user is also not yet notified of their data being held hostage.
Ransomware deployment (extortion tactic #2): This stage takes place during all ransomware attacks. The ransomware is deployed and executed, and the data is encrypted.
DDoS attack on site or network: At this point, the attack is in full force. The user is notified of the attack on their system, and they’re given instructions to pay a ransom in order to get their data back.
Read more.