It’s a cold, hard fact that hackers don’t really care about their victims or their victims’ data or business. They are greedy, evil human beings that just want the money.

The newest trend for hackers is to develop and launch cyber-attacks that deploy destructive malware. This means that when a threat actor infiltrates a business’ system, it exfiltrates the data, and in the process deploys destructive malware that destroys the victim’s data if the ransom isn’t paid. The North Korean hackers used this type of malware during the attack on Sony years ago.

Threat actors are motivated by money. First, they deploy ransomware that encrypts files so the victim has no access to its data unless it pays for the encryption key. Security professionals understand that backing up data to recover it in the event of an attack can minimize the damage and a company could recover its data without paying the ransom.

Then the threat actors figured out that exfiltrating the data and threatening to publish the data on a shame website (a double extortion attack) gave the victim another reason to pay the ransom. Many companies refuse to pay the ransom in a double extortion situation, preferring to face the consequences.

Since companies are refusing to pay in cases of double extortion attacks, the threat actors are now developing destructive code that will corrupt the data or entire servers of the victim in the event the victim refuses to pay the ransom.

According to ZDNet, cybersecurity researchers at Cyderes and Stairwell have found that

at least one ransomware group is testing “data destruction” attacks. This would be dangerous for ransomware victims because while it’s often possible to retrieve encrypted files without paying a ransom, the threat of servers being completely corrupted if extortion demands aren’t met could push more victims towards giving in.

The suspected ransomware group is BlackCat, which might be a rebrand of BlackMatter, “which in turn was a rebrand of Darkside, the ransomware operation behind the Colonial Pipeline attack.”

Sadly, the researchers predict that the prevalence of data exfiltration and destruction will only increase.