Ransomware Review: The Advent of Double Extortion

This Zscaler ThreatLabZ report examines the DarkSide ransomware attack that disrupted Colonial Pipeline and the broader advent of “double extortion” ransomware—where attackers both encrypt data and exfiltrate it for publication—highlighting an observed rise in such attacks, notable families (Maze/Egregor, Sodinokibi/REvil, Doppelpaymer, Ragnar Locker, Avaddon, Conti, DarkSide), the attack chain and business impact, and recommended Zero Trust–based protections and incident response measures.