Follow-On Extortion Campaign Targeting Victims of Akira and Royal Ransomware

Arctic Wolf Labs investigated multiple follow-on extortion incidents (Oct–Nov 2023) where actors posing as security researchers contacted organizations previously impacted by Royal and Akira ransomware, claiming access to exfiltrated data and offering to delete it for a fee. The report identifies consistent tradecraft across cases—use of Tox, file.io, low payment demands (<=5 BTC), overlapping phrasing—and concludes with moderate confidence that a single threat actor likely carried out these secondary extortion attempts, though it remains unclear whether initial ransomware groups sanctioned them.