Double-Extortion Ransomware: Leverage Phase Portrait

A double-extortion ransomware incident runs two attacks at once: encrypting files to deny access, and quietly copying sensitive data toward an external leak site to threaten publication regardless of whether the ransom is paid. This 2D companion to the 3D network simulator integrates the mean-field limit of the same exponential-hazard contagion — reducing the identical k-nearest-neighbour graph to five coupled compartments (clean, spreading, encrypted, isolated, restored) evolved by a Runge–Kutta ODE solver — and renders it as a stacked compartment chart plus a phase portrait of compromised fraction versus cumulative exfiltration leverage. Tune the attacker's lateral spread rate against the defender's SOC isolation rate and backup restore rate, or trigger an emergency full-network isolation, and watch the phase trajectory reveal the exact asymmetry the 3D model hints at but can't plot directly: compromised nodes can be walked back down, while banked leverage only ever moves right, never down.