Tracking third-party data theft across the dark web

Ransomware has evolved substantially from encrypting data to stealing it and threatening disclosure if the ransom is not paid. This research explores how data gets stolen, how it propagates across organisations, and how third parties are becoming the biggest sources of data leaks. By tracking some of the most notorious ransomware groups across the dark web, I follow the data and uncover how, when, and if it gets leaked.

Securing your company used to be synonymous with securing your data. But as companies interact with more third parties, data spreads beyond any single organisation's control. Combined with the rise of double extortion ransomware, this has fundamentally changed the threat landscape. Current attribution practices focus on the primary victim, leaving third parties unaware their data has been compromised. This creates blind spots where stolen data can be abused for targeted attacks, invoice fraud, and social engineering. This presentation addresses that gap through original research into real-world breaches.

The presentation covers the following topics:

1. Operational Security:​ How this research was performed and the operational security measures taken, to encourage more researchers to investigate this space safely.
2. Attack Overview:​How double extortion attacks unfold from both the attacker's and victim's perspectives, including initial compromise, data exfiltration, and extortion tactics. This section also addresses the attribution and tracking problem: typically, only the primary victim is identified, whilst third parties affected through the supply chain remain unmentioned.
3. Real-World Case Studies:​ Findings from investigating threat actors including Radar, Rhysida, Scattered LAPSUS Hunters, and Anubis. These cases illustrate the types of data leaked, the accuracy of threat actor claims, and how breaches cascade across supply chains:
   • Radar:​Three companies from the same industry were breached simultaneously, with nine additional companies affected, demonstrating how breaches spread far beyond the primary target.
   • Rhysida:​A compromised HR company exposed sensitive data about its clients' employees, making them more likely targets for future attacks. A separate logistics company breach revealed invoices that could enable invoice replay attacks.
   • Scattered LAPSUSHunters:​ A prominent telco was listed as compromised, but thorough investigation revealed the claims were false, highlighting the need for careful attribution before jumping to conclusions.
   • Anubis:​ Threat actors focusing on personal details and narrative building to damage company reputations.
4. Learnings:​ Practical tips for assessing how critical stolen data is, whether you are the direct victim or a third party. This includes how to communicate with threat actors to verify whether they hold valuable information, specific verification questions to test the legitimacy of their claims, and steps to take when claims turn out to be inaccurate or false.

​