NCSC on ransomware data theft and extortion tactics
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware attacks now routinely steal data alongside encryption; victims lose control regardless of ransom payment.
The UK National Cyber Security Centre published guidance on the evolving ransomware threat landscape, emphasizing that data theft is now a standard component of ransomware attacks. Criminals encrypt systems and exfiltrate data—often sensitive personal information—to pressure victims into paying ransoms under the false promise that payment ensures deletion. However, recent law enforcement action against LockBit's infrastructure revealed that data persists on attacker systems even after ransom payment, undermining the victims' assumption that payment resolves the breach.
The advisory notes that cyber criminals are adapting their tactics based on target vulnerability: ransomware with encryption disrupts logistics and manufacturing; extortion-only attacks (data theft without encryption) target sectors like healthcare where operational continuity matters less than data privacy. Stolen data is published on dark web leak sites, sold to other criminal groups or state actors, and used for downstream fraud or financial exploitation. The NCSC warns that these tactics will continue to evolve as threat actors optimize for maximum profit, and recommends organizations implement defensive measures and incident-recovery planning.
Mentioned in this report
Detection guidance
Rclone Used to Copy or Sync Data to Remote Cloud Storage
Detects rclone (including renamed binaries via OriginalFileName) running copy/sync/move with remote-transfer flags, a common ransomware data-theft and extortion exfiltration method. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Used to Copy or Sync Data to Remote Cloud Storage
description: Detects rclone, including renamed copies identified by OriginalFileName,
executing copy/sync/move with transfer or remote-config flags. Ransomware and extortion
actors commonly use this to stage and exfiltrate stolen data to cloud storage before
or instead of encryption.
tags:
- attack.exfiltration
- attack.t1567.002
- attack.t1020
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \rclone.exe
- OriginalFileName: rclone.exe
selection_action:
CommandLine|contains:
- ' copy '
- ' sync '
- ' move '
- ' copyto '
selection_flags:
CommandLine|contains:
- --transfers
- --no-check-certificate
- --auto-confirm
- --multi-thread-streams
- --config
- --ignore-existing
- 'mega:'
- 's3:'
- 'sftp:'
- 'webdav:'
condition: selection_img and selection_action and selection_flags
falsepositives:
- Administrators using rclone for sanctioned backup or cloud migration jobs
- DevOps pipelines syncing build artefacts to object storage
level: high
id: fdf0dec3-f30b-5369-8c6a-7a2e61283a71
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/whats-happened-data
Non-Browser Process Resolving Common Data-Exfiltration File Sharing Services
Detects non-browser processes querying DNS for cloud file-sharing services frequently abused to exfiltrate stolen data in extortion attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Browser Process Resolving Common Data-Exfiltration File Sharing Services
description: Detects DNS queries for consumer cloud storage and file-sharing services
(MEGA, file.io, transfer.sh style services) from processes that are not web browsers
or known sync clients. Extortion actors use these services to exfiltrate stolen
data; the volume threshold must be assessed in the SIEM, not here.
tags:
- attack.exfiltration
- attack.t1567.002
- attack.t1020
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|contains:
- mega.nz
- mega.io
- mega.co.nz
- transfer.sh
- file.io
- anonfiles
- gofile.io
filter_browsers:
Image|endswith:
- \chrome.exe
- \msedge.exe
- \firefox.exe
- \brave.exe
- \iexplore.exe
- \opera.exe
- \MEGAsync.exe
condition: selection and not filter_browsers
falsepositives:
- Users sanctioned to use MEGA through a desktop sync client under a different binary
name
- Developer tooling such as curl fetching files from transfer.sh
level: medium
id: 316e02b1-9504-56ef-abc2-1e6ef9f5bfed
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/blog-post/whats-happened-data
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/blog-post/whats-happened-data
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs