Ransomware gets personal: 'We-know-where-you-are kind of stuff'

Ransomware attacks are increasingly going beyond digital intrusions, with cybercriminals employing real-life harm and mental and physical trauma to compel victims to pay extortion demands. Tim Beasley, a senior incident response consultant at Semperis, recounted receiving a package of nesting dolls and regional gifts from Russia’s Midnight Blizzard, which he assumed was from the group linked to the Kremlin’s Foreign Intelligence Service.

Such physical souvenirs serve as a chilling reminder of the potential consequences of cyberattacks. Over the summer, Europol and its partners flagged 4,340 URLs associated with The Com, a loosely knit network of online groups involved in illicit activities such as hacking, swatting, digital extortion, and physical violence. Beasley noted that psychological intimidation and harm against employees has become increasingly common, with 37 percent of ransomware attacks involving such threats.

In fact, 53 percent of surveyed organizations reported that ransomware attackers carried through on their threats in the past year. These threats can include doxxing, psychological and medical treatment, swatting calls, and even physical violence, such as threats against family or friends, physical intrusion, abduction, bodily harm, and stalking.

Beasley emphasized that successful cybercriminals often target well-known groups like Scattered Spider, ShinyHunters, and Lapsus$. He advised victims not to buckle under pressure and to seek law enforcement involvement if they feel under duress, as paying attackers only encourages further attacks.