Berlin Refuses Ransomware Payment: How Hackers Use Tor for Extortion Campaigns

In August 2026, Berlin's state administrative network suffered a significant breach affecting multiple government departments, including the Senate Department for Mobility, Transport, Climate Protection and Environment. Following the compromise, extortionists demanded payment in exchange for not publishing or selling the stolen data. Berlin's government refused to pay, making a public stand against capitulation.

This case illustrates a broader pattern: threat actors use Tor-hosted infrastructure—leak sites, data markets, and communication channels—to anonymously conduct extortion at scale. The anonymity provided by the Tor network and onion services makes it difficult for law enforcement to track perpetrators, but it also creates predictable operational patterns that security teams can learn to recognize.

Modern ransomware and extortion operations rely on several Tor-hosted services:

| Component | Purpose | Tor Usage | |-----------|---------|----------| | Leak site | Publish stolen data previews to pressure victims | Onion address (v3) to evade takedown | | Negotiation platform | Communicate with victims and track payments | Hidden service for anonymity | | Data marketplace | Auction sensitive information to buyers | Accessible only via Tor browser | | Proxy/intermediary | Facilitate communication between gang and victim | Layered onion routing |

These operations depend on Tor's technical properties: multiple routing layers, end-to-end encryption, and the difficulty of blocking .onion domains at the ISP level. A v3 onion address (56 characters, derived from the site's public key) makes it harder for attackers to impersonate the real platform—a critical security feature when conducting high-value negotiations.

Initial Contact and Demands

After infiltrating a network, attackers typically:

1. Exfiltrate data to an external server under their control 2. Create a victim-specific communication channel via Tor (often a custom onion URL or a forum account) 3. Send an initial message with proof of access (sample files, screenshots) 4. Issue demands in cryptocurrency, with a deadline 5. Escalate pressure by publishing data samples on their leak site

Why Victims Should Not Pay (and Why Berlin Refused)

• No guarantee of deletion: Paying does not ensure attackers won't sell the data to competitors, brokers, or law enforcement
• Repeat targeting: Paying identifies an organization as willing to negotiate, increasing future targeting
• Criminal liability: In some jurisdictions, ransomware payments fund terrorist organizations or sanctioned entities
• Negotiation often increases demands: Attackers view payment as a sign to ask for more

Berlin's refusal sends a clear message and disrupts the economic model that fuels these campaigns.

Threat actors sometimes create counterfeit versions of their own leak sites or communication platforms to harvest additional credentials from victims or security researchers. When investigating a suspected extortion threat, verify the authenticity of onion addresses by:

Verification Steps

1. Check the v3 address format: Genuine v3 onion addresses are 56 characters (base32 alphanumeric) 2. Verify PGP signatures: Legitimate operations publish PGP public keys alongside communications; verify any message signature 3. Cross-reference via Tor directory: Use multiple sources to confirm the official address (not just the attacker's own announcement) 4. Test with a sandboxed Tor instance: Visit the site in an isolated virtual machine to inspect content without risk 5. Look for operational consistency: Real leak sites maintain consistent styling, payment methods, and update schedules

Red Flags for Clones

• Slight variations in the onion address (e.g., similar but not identical characters)
• Requests for payment before showing proof of data
• Poor grammar or formatting inconsistent with the real operation
• Missing or unverifiable PGP signatures
• Unusual redirect behavior (bouncing between multiple onion URLs)

Technical Mechanisms

Onion routing creates a three-layer encrypted tunnel through Tor relays:

1. Entry node (guards) → encrypted layer 1 2. Middle relay → encrypted layer 2 3. Exit node (or directly to onion service) → encrypted layer 3

For .onion addresses hosted as Tor hidden services, traffic never leaves the Tor network, meaning no exit node sees the unencrypted communication. This makes it nearly impossible for ISPs, law enforcement, or network operators to intercept the content of negotiations or data transfers.

v3 addresses use Ed25519 cryptography, making them resistant to impersonation. An attacker cannot forge a v3 address without the corresponding private key held by the hidden service operator.

| Mistake | Why It's Dangerous | How to Avoid It | |---------|-------------------|------------------| | Using clearnet browsers to access onion sites | ISP/exit node can log activity | Use Tor Browser exclusively, configured for maximum security | | Disabling Tor Browser security settings | JavaScript or plugin exploits can deanonymize | Never disable security settings; they exist for a reason | | Running Tor on an infected system | Malware can monitor Tor traffic or keylog negotiations | Isolate communication to a clean device or VM | | Clicking links from extortion emails | Phishing links can reveal IP or install malware | Manually type onion addresses; verify v3 format and PGP | | Paying from traceable sources | Blockchain analysis can link payments to identity | This requires cryptocurrency expertise; organizations should involve law enforcement and cybersecurity firms instead | | Sharing negotiation details publicly | Leaks can tip off attackers or expose operational vulnerabilities | Treat extortion communications as sensitive incident data |

| Network | Use Case | Threat Actor Advantage | Defensive Value | |---------|----------|------------------------|------------------| | Tor | Leak sites, negotiation, data markets | Resistant to ISP blocking; v3 addresses hard to impersonate; hidden services | Good for secure communication; verify v3 addresses and PGP | | VPN | Not typically used for leak sites (easier to seize servers) | Limited; VPN providers can be compelled to log traffic | Insufficient for anonymous threat actor operations | | I2P | Niche darknet; less common for extortion | More obscure; smaller target for law enforcement | Rarely used by professional ransomware gangs; not a major factor |

Ransomware operations favor Tor because it combines infrastructure resilience with technical obscurity. VPNs require trusting a provider; I2P lacks the ecosystem and user base.

Q: If we receive an extortion threat via a .onion address, should we access it? A: If your organization has cybersecurity insurance or incident response retainers, contact those parties first. They can assess the threat safely. Do not access unverified onion URLs from untrusted sources; the threat may include malicious payloads.

Q: How do I verify a threat is real and not a scam? A: Legitimate extortionists provide proof of data access (file samples, screenshots, database counts). Scammers typically send generic threats. Request a sample and verify it matches your actual data.

Q: Should we negotiate at all? A: No. Engage law enforcement and cybersecurity experts. Negotiation signals willingness to pay, escalates demands, and may violate sanctions laws.

Q: What should we do with the onion address and communications? A: Preserve them (screenshots, URLs, chat logs) as evidence. Submit to your local law enforcement cybercrime unit or to FBI/CISA (if US-based). Do not attempt to identify or retaliate against the operator.

1. Network segmentation: Assume breach and minimize lateral movement by isolating critical systems from general infrastructure 2. Backup resilience: Maintain offline, immutable backups not connected to production networks; this is the primary defense against ransomware 3. Incident response plan: Define roles, communication channels, and decision-making authority before an extortion incident occurs 4. Do not pay: Paying does not guarantee data deletion and funds criminal operations. Public refusals like Berlin's reduce the incentive to target similar organizations 5. Monitor Tor infrastructure cautiously: If your organization needs to track threat activity on onion leak sites, use isolated, air-gapped systems and verify v3 addresses meticulously 6. User awareness: Train staff to recognize phishing that leads to initial compromise; the breach usually begins before the extortion threat

Berlin's refusal to pay demonstrates that organizations with strong backups and incident response capabilities can absorb the reputational impact of a breach without capitulating to criminals. The Tor network's role in enabling extortion is significant, but it is not insurmountable—forensic investigation, threat intelligence, and operational discipline remain the most effective defenses.

Source: The Hacker News