Extortion operations are criminal campaigns that use theft, disruption, or the threat of public exposure to pressure a victim into paying. In cyber security, this often means stealing data, encrypting systems, or threatening to leak sensitive files unless a ransom is paid.
These operations matter because the goal is leverage, not just damage. Attackers may combine phishing, stolen credentials, privilege escalation, data exfiltration, and ransomware to increase pressure. Defenders should look for early access, unusual administrative activity, mass file access, backup tampering, and signs of staging or exfiltration. Tracking the extortion chain helps teams respond before encryption or leak threats create maximum impact.