Semperis: Ransomware gets personal: 'We-know-where-you-are kind of stuff'

Cybercriminals Escalate Threats with Psychological and Physical Intimidation

A recent investigation into cyberattacks by Russia’s Midnight Blizzard a group linked to the Kremlin’s Foreign Intelligence Service (SVR) took an unsettling turn when Tim Beasley, a senior incident response consultant at Semperis and former lead investigator for Microsoft’s Detection and Response Team (DART), received a package of nesting dolls and regional gifts at his home. Though the sender left no note, the incident mirrored a growing tactic among cybercriminals: real-world intimidation to pressure victims into compliance.

While digital attacks with physical consequences are not new, recent trends show a sharp rise in psychological and physical threats to coerce ransom payments. According to Semperis’ annual ransomware risk report, based on a survey of 1,200 post-ransomware organizations in the first half of 2024, 37% of ransomware attacks now involve such tactics. Attackers increasingly target not just executives and employees but also their families, using doxxing (25%), swatting (23%), and personal security threats to amplify pressure.

The report highlights alarming statistics:

• 53% of victims reported that attackers followed through on threats in the past year.
• 57% received threatening texts, letters, or packages, while 37% faced threats against family or friends.
• 19% experienced physical intrusion, 17% reported abduction threats, and 13% endured threats of bodily harm.
• 25% of victims sought psychological or medical treatment, and 24% hired personal security teams in response.

Notable threat groups, including Scattered Spider, ShinyHunters, and Lapsus$, have been linked to these tactics. While ShinyHunters claimed in an interview that they “don’t attack human beings,” they admitted to pushing corporations “to the absolute limit” to secure payments.

The report also found that 69% of ransomware victims were targeted multiple times within a year, with 31% making multiple payments reinforcing the risk of repeated extortion. Experts advise organizations to avoid paying ransoms, as compliance often leads to further demands, and to involve law enforcement early to mitigate threats.

Source: https://www.theregister.com/cyber-crime/2026/10/14/ransomware-gets-personal-we-know-where-you-are-kind-of-stuff/5302939

Semperis TPRM report: https://www.rankiteo.com/company/semperis

"id": "sem1791959243",
"linkid": "semperis",
"type": "Ransomware",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'cybersecurity',
                        'name': 'Semperis',
                        'type': 'cybersecurity firm'},
                       {'size': '1200 organizations surveyed',
                        'type': 'post-ransomware organizations'}],
 'data_breach': {'personally_identifiable_information': 'high risk (doxxing)'},
 'description': 'A recent investigation into cyberattacks by Russia’s Midnight '
                'Blizzard, a group linked to the Kremlin’s Foreign '
                'Intelligence Service (SVR), revealed escalating tactics '
                'involving real-world intimidation to pressure victims into '
                'compliance. Cybercriminals are increasingly using '
                'psychological and physical threats, including doxxing, '
                'swatting, and personal security threats, to coerce ransom '
                'payments. These tactics target executives, employees, and '
                'their families, with alarming follow-through rates.',
 'impact': {'brand_reputation_impact': 'high', 'identity_theft_risk': 'high'},
 'lessons_learned': 'Organizations should avoid paying ransoms as compliance '
                    'often leads to further demands. Involving law enforcement '
                    'early can help mitigate threats. Psychological and '
                    'physical intimidation tactics are escalating, requiring '
                    'enhanced security measures for personnel and their '
                    'families.',
 'motivation': ['financial gain', 'extortion', 'psychological coercion'],
 'post_incident_analysis': {'corrective_actions': ['Enhanced personal security '
                                                   'for employees and families',
                                                   'Law enforcement '
                                                   'collaboration',
                                                   'Psychological support for '
                                                   'affected individuals'],
                            'root_causes': 'Escalation of cybercriminal '
                                           'tactics to include psychological '
                                           'and physical intimidation for '
                                           'extortion purposes'},
 'ransomware': {'ransom_paid': '31% of victims made multiple payments'},
 'recommendations': ['Avoid paying ransoms to prevent repeated extortion',
                     'Involve law enforcement early in the incident response '
                     'process',
                     'Implement enhanced personal security measures for '
                     'executives and employees',
                     'Monitor for doxxing and swatting threats',
                     'Provide psychological support for affected individuals'],
 'references': [{'source': 'Semperis’ annual ransomware risk report'}],
 'response': {'law_enforcement_notified': 'recommended'},
 'threat_actor': ['Midnight Blizzard',
                  'Scattered Spider',
                  'ShinyHunters',
                  'Lapsus$'],
 'title': 'Cybercriminals Escalate Threats with Psychological and Physical '
          'Intimidation by Midnight Blizzard and Other Groups',
 'type': ['ransomware',
          'extortion',
          'psychological intimidation',
          'physical threats']}