Ransomware gets personal: 'We-know-where-you-are kind of stuff'

A shocking development in the world of ransomware attacks has come to light, as a senior incident response consultant from Semperis received a package containing souvenirs and gifts from an unfamiliar region. The package, which arrived while he was investigating a cyberattack involving Russia’s Midnight Blizzard, served as a chilling reminder that cybercriminals are not limited to digital threats.

In recent years, cybercriminals have increasingly turned to physical harm and psychological trauma to coerce victims into paying extortion demands. Europol and its partners have flagged over 4,340 "horrific" URLs associated with The Com, a network of online groups engaged in hacking, swatting, digital extortion, real-life shootings, and other physical violence.

A troubling trend has emerged, with 37 percent of ransomware attacks involving psychological or physical threats against staff. These threats range from doxxing (posting personal details online), to swatting calls, physical intrusion, abduction, bodily harm, and stalking. Nearly half of all ransomware victims reported experiencing such threats in the past year, with 53 percent of these threats being carried out.

Well-known groups like Scattered Spider, ShinyHunters, and Lapsus$ have been linked to psychological and physical intimidation tactics to coerce victims into paying. Lapsus$ even claimed they "don't attack human beings," but admitted that they sometimes push corporations to their limits to secure a payment.

Experts advise organizations to stand their ground, not buckle under pressure, and to seek law enforcement involvement if necessary. Semperis' report emphasizes that paying attackers only encourages further attacks, as 69 percent of surveyed victims were targeted multiple times within the past year, and 31 percent made multiple payments. "Don't pay anything," Beasley concluded.