--- title: LockBit gang plans triple-extortion tactics description: The LockBit ransomware gang has announced that it is working to take its operation to the triple-extortion level. The gang is now looking to add DDoS as an extortion tactic on top of encrypting data and exfiltrating it (to threaten future leaks). canonical_url: https://www.acronis.com/en/tru/posts/lockbit-gang-plans-triple-extortion-tactics/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 01 September 2022 # LockBit gang plans triple-extortion tactics The LockBit ransomware gang has announced that it is working to take its operation to the triple-extortion level. The gang is now looking to add DDoS as an extortion tactic on top of encrypting data and exfiltrating it (to threaten future leaks). Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** [Video 1](https://www.youtube.com/watch?v=C08iEEHKpbo) The LockBit ransomware gang has announced that it is working to take its operation to the triple-extortion level. The gang is now looking to add DDoS as an extortion tactic on top of encrypting data and exfiltrating it (to threaten future leaks). After a cyberattack against security giant Entrust, the attackers began to consider these changes. LockBit released a torrent called “entrust.com” with 343 GB of files, including legal documents, marketing spreadsheets, and accounting data. The initial ransom demand in this case was $8 million, though it later dropped to $6.8 million. Last week, LockBit demanded a ransom of $10 million from The Center Hospitalier Sud Francilien (CHSF) — a 1000-bed hospital located 28km from the center of Paris, which serves an area of 600,000 inhabitants. The [Active Protection](https://www.acronis.com/en-us/technology/active-protection/) included in Acronis Cyber Protect detects and blocks ransomware from LockBit and other groups, keeping your data safe from encryption or extortion. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)