{"id":61537,"date":"2026-10-14T05:00:00","date_gmt":"2026-10-14T05:00:00","guid":{"rendered":"https:\/\/www.theregister.com\/a\/5302939"},"modified":"2026-10-14T05:00:00","modified_gmt":"2026-10-14T05:00:00","slug":"ransomware-gets-personal-we-know-where-you-are-kind-of-stuff","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-gets-personal-we-know-where-you-are-kind-of-stuff\/","title":{"rendered":"Ransomware gets personal: ‘We-know-where-you-are kind of stuff’"},"content":{"rendered":"
<\/div>\n
<\/p>\n

cyber-crime <\/p>\n

<\/a> <\/p>\n

37% of ransomware attacks involve psychological or physical threats, global survey found <\/p>\n<\/p><\/div>\n

<\/p>\n

Tim Beasley, a senior incident response consultant at Semperis, was investigating a cyberattack involving Russia\u2019s Midnight Blizzard when a package containing nesting dolls and other regional gifts showed up on his doorstep.<\/p>\n

At the time, Beasley served as the lead investigator for Microsoft\u2019s Detection and Response Team (DART). He assumed it was from the group, which has been linked to the Kremlin\u2019s Foreign Intelligence Service (SVR), although the sender didn\u2019t leave a note. <\/p>\n

\u201cJust little souvenirs and gift basket stuff from that area of the world,\u201d he told The Register<\/span>. \u201cWe-know-where-you-are kind of stuff. It\u2019s a real eye-opener when you get that type of thing.\u201d<\/p>\n

While digital intrusions having physical consequences is nothing new, cybercriminals in recent years have turned to real-life harm<\/a> and mental and physical trauma<\/a> to force victims into paying extortion demands. Some groups even use cybercrime as a gateway drug to real-life violence.<\/p>\n

Over the summer, Europol and its partners’ investigators flagged 4,340 \u201chorrific\u201d URLs for removal as part of an ongoing crackdown on The Com<\/a> (short for community), a loosely knit network of online groups whose young members participate in a range of illicit activities including hacking, swatting<\/a>, digital extortion, real-life shootings<\/a>, and other physical violence<\/a>.<\/p>\n

\u201cWe\u2019ve seen violence as a service get used,\u201d Beasley said. <\/p>\n

He\u2019s also investigated ransomware attacks where C-suite executives receive pictures of their kids\u2019 schools directly from the cybercriminals in an attempt to apply psychological pressure to pay the extortion fee.<\/p>\n

\u201cI’ve seen threats involving people’s families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate,\u201d Beasley said. <\/p>\n

This type of psychological intimidation and harm against victim companies\u2019 employees has seen an uptick<\/a> in the last several years to the point where it’s almost common. Thirty-seven percent of ransomware attacks involved psychological or physical threats against staff, according to Semperis\u2019 annual ransomware risk report<\/a>. <\/p>\n

The global study of 1,200 post-ransomware organizations conducted over the first half of the year found attackers threatening psychological intimidation (23 percent) and physical threats (17 percent), to force payment. They are not only targeting executives and staff, but also families of their victims. <\/p>\n

A quarter of these victims experienced doxxing<\/a> \u2013 posting individuals’ personal details, such as names, home and work addresses, and phone numbers online \u2013 while another 25 percent had to seek psychological and\/or medical treatment in response to ransomware infections. Nearly the same number (24 percent) hired personal security teams, while 23 percent experienced swatting calls<\/a> \u2013 that’s when attackers phone emergency services and report a bogus incident like a bomb or active-shooter threat to trigger an armed response.<\/p>\n

Additionally, more than half (53 percent) of respondents reported that ransomware attackers carried through on threats in the past year. Some of these threats reported by ransomed organizations\u2019 employees include:<\/p>\n