Ransomware crews increasingly use psychological and physical threats to force payment

Threats reach beyond the network

Cybercriminals are adding real-life harm, mental pressure and physical trauma to digital extortion, according to Semperis. Senior incident response consultant Tim Beasley said attackers have targeted executives, staff and families to force payment, and investigators are seeing violence used as a service.

Beasley, who investigated an attack involving Russia's Midnight Blizzard, said a package with nesting dolls and regional gifts once arrived at his doorstep while he was lead investigator for Microsoft's Detection and Response Team. He assumed it came from the group linked to the Kremlin's Foreign Intelligence Service, and no note was included.

Survey finds intimidation is common

Semperis reported that 37 percent of ransomware attacks involved psychological or physical threats against staff. The global study surveyed 1,200 post-ransomware organizations during the first half of the year and listed psychological intimidation at 23 percent and physical threats at 17 percent.

The report said a quarter of victims experienced doxxing, meaning personal details such as names, home and work addresses and phone numbers were posted online. Another 25 percent sought psychological or medical treatment after ransomware infections, 24 percent hired personal security teams and 23 percent experienced swatting calls in which emergency services were sent over a bogus incident such as a bomb or active-shooter threat.

More than half of respondents, 53 percent, said attackers carried through on threats in the past year. Reported examples included threatening texts, letters or packages at 57 percent, threats against family or friends at 37 percent, physical intrusion at 19 percent, abduction at 17 percent, bodily harm at 13 percent and stalking at 6 percent.

Defenders urged to involve law enforcement

Beasley named Scattered Spider, ShinyHunters and Lapsus$ among better known groups that use psychological and physical threats to force payments. ShinyHunters has said it does not attack human beings, while acknowledging that it sometimes pushes corporate targets to the absolute limit to get them to the table.

Europol and its partners flagged 4,340 URLs for removal over the summer during an ongoing crackdown on The Com, a loosely knit online network whose young members participate in hacking, swatting, digital extortion, real-life shootings and other violence.

Beasley advised executives and defenders to stand their ground, not buckle under pressure, involve law enforcement and the FBI early and refuse to pay. The report found 69 percent of surveyed ransomware victims were targeted again within 12 months, and 31 percent made multiple payments.

Sources: The Register