Ransomware Attacks Bring Threats to Employees’ Families and Homes
A Semperis survey found that 37% of ransomware attacks involved psychological or physical threats against staff, while a separate report cited AI use in 84% of…
Ransomware attacks are increasingly reaching beyond compromised systems and into victims’ personal lives. A Semperis survey found psychological or physical threats against staff in 37% of attacks, while another report said attackers used artificial intelligence in 84%.
The threats can involve employees’ families, doxxing and attempts to trigger armed emergency responses, adding a personal cost to extortion alongside the loss of access to data. Tim Beasley, a senior incident response consultant at Semperis, said he received a package of regional gifts while investigating a cyberattack involving Russia’s Midnight Blizzard.
Beasley, who was then lead investigator for Microsoft’s Detection and Response Team, said he assumed the package came from the group, which has been linked to the Kremlin’s Foreign Intelligence Service. The sender left no note.
“We-know-where-you-are kind of stuff. It’s a real eye-opener when you get that type of thing,” Beasley told The Register.
Threats reach families and homes
Beasley said he had investigated ransomware cases in which cybercriminals sent senior executives pictures of their children’s schools to pressure them into paying. Attackers also used information gathered from social media to threaten victims’ families.
“I've seen threats involving people's families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate,” he said.
Semperis’ annual ransomware risk report drew on a global study of 1,200 organizations that had experienced ransomware, conducted over the first half of the year. It found psychological intimidation in 23% of cases and physical threats in 17%.
A quarter of respondents said they experienced doxxing, in which personal details such as names, addresses and phone numbers are published online. Another 25% sought psychological or medical treatment after an infection, while 24% hired personal security teams. Swatting calls, in which attackers make false reports to emergency services to prompt an armed response, affected 23%.
The effects can persist even after an organization deals with an attack. More than half of respondents, 53%, said ransomware attackers had carried out threats in the past year. Among the threats reported by employees, 57% involved threatening texts, letters or packages, and 37% involved threats against family or friends.
That changes the stakes for staff and their families. Ransomware response is no longer only a technical recovery problem: the survey figures describe people seeking treatment or security after threats tied to an attack.
AI adds another tool for extortion
A separate Semperis finding cited by Yahoo Finance said AI was used in 84% of ransomware attacks. The report described offenders using the technology to make scams and attacks more sophisticated, including impersonation and phishing tactics that can trick people into handing over sensitive information.
Chris Inglis, a strategic adviser to Semperis and former U.S. National Cyber Director, said attacks could operate with less direct human involvement. “I think we're already seeing autonomous attacks. Autonomous ransomware attacks are included in the mix,” he told CBS News.
Inglis said AI could expand attackers’ ability to identify weaknesses and increase the scale and sophistication of their approach. The report also found 69% of respondents had experienced more than one attack in the past year.
Beasley said well-known groups had used psychological and physical pressure to seek payment, naming Scattered Spider, ShinyHunters and Lapsus$. He also pointed to a wider pattern of online abuse spilling into real-world harm: Europol and partner investigators flagged 4,340 URLs for removal over the summer as part of a crackdown on The Com, a network whose activities include hacking, digital extortion and physical violence.
Source: theregister.com
