Emerging ransomeware threats: An anticipatory ethical anaylsis

Ransomware has become a primary security risk to businesses, and it is now the fastest-growing category of cybercrime. Furthermore, ransomware attacks on healthcare, energy and water distribution, and defense contractor organizations have begun to impact both business and national security. Traditional ransomware encrypts files on an infected computer which blocks users’ access until a sum of money or ransom is paid, often via cryptocurrencies like Bitcoin or Ethereum. Businesses and individuals who become victims of ransomware attacks are faced with the expense of paying the ransom, or restoring files from backup if this available, losing files altogether or completely restoring the files. Beginning in late 2019, cybercriminals stepped up their game by deploying new attacks known as “double-extortion” ransomware, within which files are stolen before being encrypted. Even if an organization might be able to recover its data from backups, by stealing the files first before the files are encrypted, the attacker can still profit either by selling any confidential data on the dark web or by further extorting the business and threatening to leak sensitive information unless an even larger ransom is paid. As of 2021, double-extortion ransomware is still in its infancy, but it can be anticipated that possible long-term trends toward even more persistent multiple-extortion tactics, in which stolen data could continue to be used by cybercriminals, terrorists, and rogue nation-states potentially decades in the future will continue. Traditional, passive measures in cybersecurity and business continuity, like firewalls, antivirus software, and frequent backups, are not sufficient to protect organizations from this new type of data theft and extortion enterprise. Government agencies and private corporations alike are beginning to employ active cyber threat hunters and intelligence analysts to detect and neutralize this newest class of persistent threat. This anticipatory ethical analysis will attempt to identify future threats from the development of Multiple-Extortion Ransomware and use this ethical analysis as the basis for developing policy about future ransomware developments.