Data-Only Extortion Is Rising as Criminals Move Beyond Encryption
Summary
Unit 42 describes a shift toward data-only extortion, outlines actors’ supply-chain and vishing tactics, and recommends defenses including egress monitoring, phishing-resistant MFA, and stronger CI/CD controls.
Key points
- Unit 42 says encryption appeared in 78% of extortion-related cases in 2025, down from near or above 90% in 2021–2024.
- The article reports that mid-sized organizations made up 64% of victims in 2025 data-exfiltration campaigns, with professional services, healthcare, and consumer services heavily targeted.
- TGR-CRI-1135 (TeamPCP) is described as using software supply-chain compromise and partnering with extortion and ransomware operators.
- Bling Libra (also known as ShinyHunters) uses vishing to steal credentials and MFA codes, then registers its own devices in targeted SaaS environments.
- CL-CRI-1116, which overlaps with public reporting on BlackFile, is described as using swatting as an extortion tactic and rebranding its program as Redact.
- Unit 42 recommends monitoring unusual data egress, auditing SaaS access, adopting phishing-resistant MFA, and strengthening software supply-chain controls.
Article Details
- Publisher
- Unit 42, Palo Alto Networks
- Report Period
- 2025–2026; includes 2025 statistics and May 2026 developments
- Scope
- Data-theft extortion trends, threat-actor tactics, AI-related risks, and defensive recommendations
- Sample Size
- Not disclosed
- Key Statistics
- Encryption was used in 78% of Unit 42 extortion-related cases in 2025, compared with near-or-above-90% levels in 2021–2024.
- Google reported data-theft and extortion incidents rising from approximately 2% in 2020 to 15% in 2025.
- Resilience observed extortion-only incidents increasing from 49% in the first half of 2025 to 65% in the second half.
- Mid-sized organizations accounted for 64% of victims in 2025 pure data-exfiltration campaigns.
- The reported average cost of data-theft extortion was $5.08 million, and broader U.S. breaches could exceed $10 million.
- Recommendations
- Deploy DLP controls at cloud, endpoint, and network egress points; baseline and alert on abnormal egress volume and velocity, and monitor for staging behavior.
- Audit SaaS OAuth grants, third-party integrations, and API permissions; enforce conditional access and aggregate SaaS audit logs for anomaly detection.
- Use phishing-resistant FIDO2/WebAuthn authentication, strengthen help-desk identity verification, and conduct targeted vishing simulations.
- Use software composition analysis and dependency pinning in CI/CD; rotate and vault exposed secrets, monitor package registries, and enforce code signing and provenance verification.
- Pressure-test detection and response against compressed timelines, prioritize remediation of internet-facing and AI-discoverable vulnerabilities, and verify inbound calls.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe phishing sites used by Bling Libra are described as intercepting victim credentials.T1098.005 · Device RegistrationBling Libra operators register their own devices to establish persistence in targeted environments.T1111 · Multi-Factor Authentication InterceptionBling Libra's phishing sites are described as intercepting multifactor authentication codes.T1195.002 · Compromise Software Supply ChainTGR-CRI-1135 is reported to conduct software supply chain compromise attacks, including injecting malicious code into software.T1498 · Network Denial of ServiceBling Libra uses distributed denial-of-service attacks as an additional extortion pressure tactic.T1566.004 · Spearphishing VoiceBling Libra and the CL-CRI-1116 activity cluster use vishing as an initial-access technique.
People
Threat Actors
BlackFileUnit 42 tracks this activity cluster as using phishing sites and a Tor-based leak site, and reports that it uses employee swatting as an additional extortion tactic.Bling LibraUnit 42 reports that this group uses vishing to infiltrate SaaS tenants for data theft and extortion, and also uses DDoS attacks and media leaks as pressure tactics.ClopExplicitly identified as an alias of Hazy Scorpius, which Unit 42 reports has used an Oracle EBS vulnerability in data-theft extortion activity.Hazy ScorpiusUnit 42 reports that this group has used an Oracle EBS vulnerability in data-theft extortion activity.LAPSUS$ GroupUnit 42 reports that TGR-CRI-1135 has collaborated with its operators to extort targeted organizations through a data leak site.ShinyHuntersExplicitly identified as an alias of Bling Libra; Unit 42 describes the group as focusing on SaaS applications and data-theft extortion.TeamPCPExplicitly identified as an alias of TGR-CRI-1135, which is reported to conduct software supply chain compromise and data-exfiltration activity.TGR-CRI-1135Unit 42 reports that this group conducts software supply chain compromise and data-exfiltration activity, and has partnered with ransomware-as-a-service and extortion-as-a-service operators.VectUnit 42 reports that TGR-CRI-1135 has worked with Vect ransomware operators, based on communications observed on BreachForums.
Malware
Vendors
AnthropicFor example, Anthropic recently disclosed how Mythos was able to identify approximately 23,000 potential vulnerabilities across 1,000 open source software projects.Oraclefocus on software-as-a-service (SaaS) applications and Hazy Scorpius’s (aka CLOP) exploitation of an Oracle EBS vulnerability.
Products
ATHRWith regards to vishing, AI-powered call center platforms like ATHR can nearly fully automate these attacks for human operators by utilizing AI agents to manage calls and other aspects of the intrusion lifecycle.MythosRegulators, class-action risk, and frontier AI models such as Mythos are reshaping the threat landscape by compressing attack timelines and making pure data extortion more effective.Oracle E-Business Suitefocus on software-as-a-service (SaaS) applications and Hazy Scorpius’s (aka CLOP) exploitation of an Oracle EBS vulnerability.
Industries
ConstructionInterestingly, while Manufacturing remains the single most disrupted sector overall, Construction has witnessed a 44% year-over-year increase as a data-only extortion hotspot.Consumer ServicesMid-sized firms in professional services, healthcare, and consumer services are heavily targeted.HealthcareMid-sized firms in professional services, healthcare, and consumer services are heavily targeted.ManufacturingInterestingly, while Manufacturing remains the single most disrupted sector overall, Construction has witnessed a 44% year-over-year increase as a data-only extortion hotspot.Professional ServicesMid-sized firms in professional services, healthcare, and consumer services are heavily targeted.