Privacy Ninja

Ransomware Gang Now Lets you Search their Stolen Data

Ransomware Gang Now Lets you Search their Stolen Data

Two ransomware gangs and a data extortion group have adopted a new strategy to force victim companies to pay threat actors to not leak stolen data.

The new tactic consists in adding a search function on the leak site to make it easier to find victims or even specific details.

At least two ransomware operations and a data extortion gang have adopted the strategy recently and more threat actors are likely to do the same.

Easy finding victim data

Last week, the ALPHV/BlackCat ransomware operation announced that they created a searchable database with leaks from non-paying victims.

The hackers made it clear that the repositories have been indexed and the search works when looking for information by filename or by content available in documents and images.

The results are pulled from the “Collections” part of BlackCat’s leak site and may not have the best accuracy but it is still an evolution of the cybercriminal’s extortion strategy.

Also Read: The 5 Phases of Penetration Testing You Should Know

ALPHV/BlackCat ransomware implements search function on leak site
Search option on ALPHV ransomware leak site
Source: BleepingComputer

BlackCat ransomware operators claim that they do this to make it easier for other cybercriminals to find passwords or confidential information about companies.

The gang already tried this strategy in mid-June, when they created a searchable site with data allegedly stolen in an attack at a hotel and spa in Oregon.

The site allowed guests at the spa locations and employees to check if their personal information had been stolen during the ransomware attack.

Victim's search data leak site
Victim’s search data leak site
Source: BleepingComputer

This is a step forward in the extortion business as it puts pressure on the victim to pay the ransom and have the data removed from the web and avoid the potential risk of class action lawsuits.

Towards the end of last week, BleepingComputer noticed that LockBit offered a redesigned version of their data leak site that allowed searching for listed victim companies.

Also Read: Got Hacked? Here Are 5 Ways to Handle Data Breaches

Search on LockBit ransomware leak site
LockBit added instant search option on data leak site
Source: BleepingComputer

LockBit’s search is not as advanced as the variant touted by BlackCat, and it is limited to only finding victims by name.

However, even in this basic form, the gang’s implementation of the search function still makes it easier to locate on their leak site data from specific companies.

Another leak site that has implemented a search function is the one published by the Karakurt data extortion gang. BleepingComputer’s attempts to use the option showed that it did not work properly, though.

Karakurt data extortion gang adds search to leak site
Search bar on Karakurt data extortion gang’s site
Source: BleepingComputer

Data extortionists are just starting to explore the search feature. It is unclear if making stolen data searchable is a successful tactic but with multiple extortionist gangs adopting it, the option seems to be an attractive one.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.

Powered by WhatsApp Chat

× Chat with us