Extortion Campaign Targeting Victims of Akira, Royal Ransomware

Arctic Wolf Labs documents multiple follow-on extortion incidents (Oct–Nov 2023) in which actors claiming to be security researchers contacted prior Royal and Akira ransomware victims, asserted access to exfiltrated data, and offered to delete or return it for a small fee; stylistic and behavioral overlaps (communication via Tox, use of file.io, low payment demands, overlapping phrases) lead analysts to conclude with moderate confidence a common actor conducted these campaigns, though links to the original ransomware groups remain unclear.