Ransomware Evolves: Attackers Employ Psychological and Physical Threats
Ransomware attacks are increasingly incorporating psychological and physical threats against victims and their families, with a significant percentage of incidents involving doxxing, swatting, and direct intimidation to force payment.
Ransomware attacks are escalating beyond digital extortion, with threat actors increasingly employing psychological and physical intimidation tactics to coerce victims into paying ransoms. A recent investigation by Semperis revealed that a substantial 37% of ransomware attacks now involve such threats, aiming to inflict real-world harm and mental distress.
These tactics range from doxxing, where attackers publish victims' personal information online, to swatting, which involves falsely reporting emergencies to law enforcement to trigger a disruptive and dangerous armed response at the victim's location. In some extreme cases, cybercriminals are using ransomware as a gateway to more direct forms of real-life violence and stalking.
Tim Beasley, a senior incident response consultant at Semperis, shared a personal account of receiving a package of "souvenirs" at his doorstep while investigating a cyberattack, which he interpreted as a chilling "we-know-where-you-are" message from the threat actors. He has also encountered instances where executives received photos of their children's schools, a clear attempt to leverage family safety for financial gain.
The Semperis report, which surveyed 1,200 organizations post-ransomware attack, found that 23% of attackers used psychological intimidation and 17% employed physical threats. These threats are not limited to high-level executives; employees and their families are also increasingly targeted.
Beyond doxxing and swatting, the report highlighted that a quarter of victims required psychological or medical treatment due to ransomware infections. Nearly the same number hired personal security teams. Worryingly, over half of the respondents (53%) confirmed that ransomware attackers followed through on their threats in the past year, with reported threats including direct physical intrusion, abduction, and stalking.
Well-known ransomware groups, including Scattered Spider, ShinyHunters, and Lapsus$, have been implicated in using these aggressive tactics. While some groups, like ShinyHunters, have claimed not to target individuals directly, they acknowledge pushing corporate entities to their limits.
Beasley advises organizations to "stand their ground" and not succumb to pressure, emphasizing the importance of involving law enforcement early. He strongly advises against paying ransoms, noting that victims who pay are often targeted repeatedly. The Semperis report supports this, indicating that 69% of surveyed victims were targeted multiple times within the past year, and 31% made multiple payments.
The evolving nature of ransomware attacks, incorporating real-world intimidation and threats, underscores the need for a comprehensive security strategy that addresses not only digital defenses but also the psychological and physical well-being of employees and their families.