An extortion chain is the sequence of steps criminals use to pressure a victim after gaining leverage. It usually starts with contact and a threat, then adds proof of access, deadlines, and escalating demands. Common pressure points include stolen data, public leak threats, harassment, impersonation, or denial-of-service attacks. In ransomware cases, different people may handle intrusion, negotiation, and payment collection, making the chain a coordinated business process rather than a single message.
This matters because defenders must break the whole chain, not just remove malware. Even if encryption is contained, attackers may continue with emails, chat messages, phone calls, or leak-site posts. Monitoring for data exfiltration, suspicious outbound contact, and repeated intimidation can reveal the extortion phase early. Strong incident response also includes legal, communications, and law-enforcement coordination so the target can document threats, reduce leverage, and respond consistently.