Imagine you are a cybersecurity expert investigating a cyberattack linked to a dangerous Russian threat actor. And one day, a package filled with matryoshka dolls and other gifts related to Russian folklore appears at your doorstep.
That is precisely what happened to Tim Beasley, currently a senior incident response consultant at Semperis, in a story published by The Register.
Beasley was not exactly a nobody. When that package arrived at his doorstep, he was working as the lead investigator for Microsoft’s Detection and Response Team (DART).
At that time, he was analyzing an incident involving the dangerous APT group Midnight Blizzard, directly linked to the Kremlin’s Foreign Intelligence Service (SVR). The sender left no note, but the message was more than clear: we know who you are and where you live.
It’s not the first time something like this has happened. In fact, it’s more common than it seems among security researchers. Cybercriminals want to instill fear among those who can expose them and dismantle their services and infrastructures. Beasley himself recounts how they have seen violence-as-a-service being used.
The expert even talks about investigating cyberattacks where top executives of companies compromised by ransomware incidents receive photos of their children’s schools. Cybercriminals not only want to scare them but also pressure them to pay astronomical ransoms.
“I’ve seen threats involving people’s families, obtained through social media spying, and in our world, it’s becoming more common, which is unfortunate,” Beasley highlights.
Not only do they target employees, but also their families
This psychological intimidation and harm against companies victimized by extortion have been increasing. This is shown in Semperis’s latest annual ransomware risk report, which notes that 37% of these attacks involved some form of psychological or physical threat against personnel. Sometimes cybercriminals don’t settle for scaring employees. They cross another line and target their families as well.
A quarter of these victims suffered doxing (having their personal data like names, home and work addresses, and phone numbers published online), while another 2% had to seek psychological or medical treatment due to ransomware infections.
Another 24% hired personal security teams, while 23% experienced false emergency calls (reporting a fake incident, like a bomb threat or shooting, to provoke an armed response).
As we mentioned, receiving intimidating packages is commonplace. The cited report includes some of the threats reported by employees of organizations affected by ransomware. Leading by far are threatening text messages, letters, or packages (at 57%). Following are threats to friends or family (37%), and much lower are physical intrusion (19%), kidnapping (13%), and bodily harm (13%).
Beasley comments that these pressure activities to force payments are mainly carried out by large ransomware groups, such as Scattered Spider, ShinyHunters, or Lapsus$ (together forming the so-called Chaos Triad).
Don’t pay a dime, despite the extortion
In this regard, the incident response consultant at Semperis advises staying firm. “Don’t give in to pressure and know that everything will be okay. If you feel coerced, don’t hesitate to contact the authorities. Don’t be afraid to call the police. Don’t be afraid to involve the FBI as soon as possible. And don’t pay them,” he suggests.
For the expert, this is a line that should not be crossed. Victims may loosen their wallets seeking some relief or peace of mind, but it only leads to threat actors growing bolder and coming back for more money. The data confirms it. The Semperis report shows that 69% of those affected by ransomware were attacked multiple times, and 31% made multiple payments to the attackers.
Imagine you are a cybersecurity expert investigating a cyberattack linked to a dangerous Russian threat actor. And one day, a package filled with matryoshka dolls and other gifts related to Russian folklore appears at your doorstep.
That is precisely what happened to Tim Beasley, currently a senior incident response consultant at Semperis, in a story published by The Register.
Beasley was not exactly a nobody. When that package arrived at his doorstep, he was working as the lead investigator for Microsoft’s Detection and Response Team (DART).
At that time, he was analyzing an incident involving the dangerous APT group Midnight Blizzard, directly linked to the Kremlin’s Foreign Intelligence Service (SVR). The sender left no note, but the message was more than clear: we know who you are and where you live.
It’s not the first time something like this has happened. In fact, it’s more common than it seems among security researchers. Cybercriminals want to instill fear among those who can expose them and dismantle their services and infrastructures. Beasley himself recounts how they have seen violence-as-a-service being used.
The expert even talks about investigating cyberattacks where top executives of companies compromised by ransomware incidents receive photos of their children’s schools. Cybercriminals not only want to scare them but also pressure them to pay astronomical ransoms.
“I’ve seen threats involving people’s families, obtained through social media spying, and in our world, it’s becoming more common, which is unfortunate,” Beasley highlights.
Not only do they target employees, but also their families
This psychological intimidation and harm against companies victimized by extortion have been increasing. This is shown in Semperis’s latest annual ransomware risk report, which notes that 37% of these attacks involved some form of psychological or physical threat against personnel. Sometimes cybercriminals don’t settle for scaring employees. They cross another line and target their families as well.
A quarter of these victims suffered doxing (having their personal data like names, home and work addresses, and phone numbers published online), while another 2% had to seek psychological or medical treatment due to ransomware infections.
Another 24% hired personal security teams, while 23% experienced false emergency calls (reporting a fake incident, like a bomb threat or shooting, to provoke an armed response).
As we mentioned, receiving intimidating packages is commonplace. The cited report includes some of the threats reported by employees of organizations affected by ransomware. Leading by far are threatening text messages, letters, or packages (at 57%). Following are threats to friends or family (37%), and much lower are physical intrusion (19%), kidnapping (13%), and bodily harm (13%).
Beasley comments that these pressure activities to force payments are mainly carried out by large ransomware groups, such as Scattered Spider, ShinyHunters, or Lapsus$ (together forming the so-called Chaos Triad).
Don’t pay a dime, despite the extortion
In this regard, the incident response consultant at Semperis advises staying firm. “Don’t give in to pressure and know that everything will be okay. If you feel coerced, don’t hesitate to contact the authorities. Don’t be afraid to call the police. Don’t be afraid to involve the FBI as soon as possible. And don’t pay them,” he suggests.
For the expert, this is a line that should not be crossed. Victims may loosen their wallets seeking some relief or peace of mind, but it only leads to threat actors growing bolder and coming back for more money. The data confirms it. The Semperis report shows that 69% of those affected by ransomware were attacked multiple times, and 31% made multiple payments to the attackers.
Click Here For The Original Source.
——————————————————–
