Doxware, a blend of doxing and ransomware, is a type of malware that, like classic ransomware, encrypts the files of a user or organization. But unlike the latter, doxware adds an element of blackmail: it threatens to publicly disclose personal or sensitive data if the ransom is not paid.

This attack method relies on double psychological pressure: not only is access to the data blocked, but the fear of a leak of critical information (internal documents, customer data, personal or compromising information) is used to force the victim to pay more quickly.

How doxware works

Doxware follows a process similar to that of classic ransomware. After infecting a system, it encrypts the data or accesses sensitive files. The attacker then threatens to publish them on the internet, on the dark web, or via public distribution platforms.

The attack can unfold in several stages:

  • Infiltration of the system via a malicious attachment, a phishing link, or an unpatched vulnerability.
  • Identification and extraction of sensitive files, often automatically via scripts.
  • Encryption of local data, sometimes with an exfiltrated copy.
  • Display of a ransom message stating the amount demanded and the threat of disclosure in case of refusal.

In some cases, doxware does not encrypt the data but simply steals it and threatens to expose it, which reduces the technical impact but increases the moral pressure.

Origin of the term and link with doxing

The term doxware is a blend of:

  • Doxing : the practice of collecting and publishing personal or confidential information about an individual without their consent.
  • Ransomware : ransom software that encrypts data and demands payment to return it.

Doxware therefore combines these two approaches: digital hostage-taking (ransom) and the threat of public shaming or public compromise (doxing).

Targets and motivations

Doxware can target both individuals and businesses, but it is particularly dangerous for:

  • Companies holding sensitive data (healthcare, legal, finance sectors, etc.)
  • Public figures, influencers, journalists, or politicians
  • SMBs, which are often less well protected and more inclined to pay to avoid bad publicity

Attackers' motivations are mainly financial, but in some cases, ideological, political, or personal reasons may also come into play.

Consequences of a doxware attack

The impact of doxware goes well beyond the mere loss of access to files. It can include:

  • Loss of confidentiality : HR data, contracts, internal communications, or customer information published online.
  • Reputational damage: loss of trust from partners, customers, or employees.
  • Legal risks: especially in the event of a leak of personal data protected by the GDPR.
  • Financial losses: related to the ransom, business downtime, potential fines, or remediation costs.

Prevention and protection

With the rise of doxware attacks, it is essential to adopt a comprehensive cybersecurity strategy combining protection, anticipation, and response.

Here are some key measures:

Before a doxware attack: prevent

  • Active awareness of phishing emails: to avoid the unfortunate clicks behind many intrusions
  • Regular updates : to close the security gaps exploited by cybercriminals
  • Network monitoring: to quickly detect any abnormal behavior or exfiltration attempt
  • Local encryption of sensitive data: to guarantee its confidentiality even in the event of theft

After a doxware attack: limit the damage

  • Automated, encrypted data backup: to restore files without giving in to blackmail, thanks to a solution like Kiwi Backup
  • Rapid restoration: to resume operations as quickly as possible and limit service interruptions
  • Post-incident audit and traceability: to identify the origin of the attack and strengthen security measures

Conclusion

Doxware is a growing threat in the world of cyberattacks, playing on the fear of public exposure. In addition to blocking access to files, it threatens their release, forcing victims to give in quickly to the attackers' demands.

To protect against this type of attack, companies must adopt a proactive posture, including regular data backups, a zero trust model, increased vigilance against phishing, and a strict access management policy.

Investing in an automated and secure backup solution is today one of the most effective ways to minimize the impact of an attack and ensure the resilience of your IT infrastructure.