Fraud Management & Cybercrime
,
Ransomware
Ransomware Hackers Discover Violence as Digital Defenses Stymie Extortion
Shaun Waterman •
October 15, 2026
Image: Shutterstock
Ransomware gangs are turning to real world threats against business executives and even their families to gain leverage in negotiations as enterprises boost their cyber resilience and become less willing to pay extortion, a survey commissioned by identity-centered cybersecurity vendor Semperis found. See Also: From Flat to Fortified: Segment Your Water Network Without Stopping the Process
“We’ve still got a long way to go but we’ve got better at those detection, protection, response, and recovery capabilities,” said Simon Hodgkinson, veteran CISO and strategic advisor to Semperis. “The ransom payments are reducing – they’re still incredibly high, by the way – but the ransom payments are reducing.”
The company’s third annual ransomware risk report shows a continuing decrease in the proportion of victimized organizations that paid a ransom: 59% this year, down from 69% last year and 78% in 2024.
Faced with mounting reluctance on the part of victims with working back-ups to pay a ransom, criminals are turning to old-school extortion tactics. “They turn it back from a data-centric crime to a people-centric crime again, and the pressure point from a people perspective is fear, human fear,” Hodgkinson told ISMG.
The use of personal threats against victim company staff and their families is a third stage of ransomware evolution, Hodgkinson said.
At first, ransomware gangs could get away with just encrypting data, he said. “Very low entry barriers, very low risk.” But as companies began adopting resilient backups, the gangs moved on to double extortion, encrypting the company’s data and threatening to publicly dump decrypted troves of it, for reporters, regulators and competitors to comb through.
As companies became better at detecting and mitigating ransomware attacks and more reluctant to cough up, ransomware gangs have added threats of personal violence to the mix. “They are doing whatever they need to do to get paid,” he concluded.
“Holding you at physical risk is the latest phenomenon because we’ve covered most of the other risks,” added former US National Cyber Director Chris Inglis, another Semperis strategic advisor, in a statement.
Independent experts and practitioners generally said the Semperis report’s conclusions are in line with their own experience. Although some cautioned that it is important to rigorously distinguish between threats of physical violence and actual assaults or attacks, which were much rarer.
‘We know exactly where you live’
“I’ve seen instances where C-level executives have been threatened via text,” said Semperis Senior Incident Response Consultant Tim Beasley. “They’ll all of a sudden get a picture of their kid’s school [or] …. an image of their license plate” on their phone. “It becomes real for them real quick,” he added.
He said the use of real world threats, and remote real world intimidation tactics such as doxxing or swatting are “more prevalent in Europe and the Middle East. In the Americas, it’s not super common. I mean, it happens.”
Doxxing involves publishing a person’s home address, email addresses, social media handles, plus sometimes personal information about their children or other relatives, on the internet, often with subtle or not so subtle suggestions about the uses to which it might be put. Swatting involves false reports to the police designed to ensure an armed response at the victim’s address.
Beasley added that, even in the Americas, “some people are unfortunately crazy enough to carry out the threats,” and follow through with acts of violence. The report does not appear to record any actual acts of violence, although a handful of practitioners agreed with Beasley that they do occur, albeit rarely.
Beasley himself, while working for Microsoft, and tracking the Russian intelligence-linked threat group they called Midnight Blizzard received at his home address a “goodie bag” containing Russian handicrafts and gifts including a matryoshka set of hollow wooden nesting dolls, a classic Russian folk art item.
There was no message, but the meaning was clear: “It’s a threat,” Beasley said, “It says, ‘We know exactly where you live,’ right? And for me personally, I’m like, ‘Bring it on!’ But for others, it freaks people out.”
Violence-as-a-Service: Transforming the Dynamics of a Negotiation
The existence of “violence-as-a-service” – the ability of cyber threat actors to procure local criminals a half a world away to commit assaults or acts of mayhem – pioneered by the loose network of vicious cybercriminals dubbed The Com, means that organizations cannot afford to ignore threats of real world assaults, break-ins and other acts of violence, Beasley said.
The use of personal threats against C-suite executives, and even more so their families, can completely transform the dynamics of a negotiation, said Matt Polak, CEO of VanishID, a company that provides external identity security by reducing the digital footprint of company executives.
Once the spouse or other family members are involved, Polak told ISMG, conversations can “start being driven by issues raised at the kitchen table, rather than the ones raised at the boardroom table.”
Personal threats don’t just provide leverage in negotiations, Polak explained. Some cybercrime groups use them as an alternative vector for technical penetration.
He recalled the case of “a mid-level executive” who had “sensitive access to internal systems,” and whose phone was infected with info-stealer malware by a ransomware gang. “They had everything. Imagine what someone could get if they had all your passwords, all your accounts: Your whole life laid out.”
The gang tried to use that leverage “to try to get him to plug a USB device into a computer at work,” Polak said. “Luckily, he did the right thing” and went to his corporate security team. But the case illustrates another cybercrime use case for personal or real world threats.
Still, there is a critical difference between “threats and actual violence,” said Ian Gray, vice president of intelligence for Flashpoint, a threat intel service.
Remote real world intimidation tactics like “doxxing, harassment, and swatting are established tactics in parts of the cybercriminal ecosystem,” said Gray, and could be accomplished remotely, “particularly when criminals have access to personal information about executives, employees, or their families.”
“The important distinction is that the ability to threaten someone remotely doesn’t necessarily mean an actor has the capability or intention to demonstrate physical violence,” Gray said
Although there is “a criminal ecosystem where personal intimidation is increasingly accessible as a tactic,” Gray noted, “Carrying out physical attacks is another level of escalation, and we need to be careful not to treat those [real violence] activities as equally prevalent,” he said.
Assessing the credibility of real world threats “requires looking at the specific actor, their history, their connections, and any evidence that they’re taking steps beyond making threats,” Gray said.
——————————————————–
Click Here For The Original Source.
