Ransomware Hackers Resort to Real-World Threats Amidst Increasing Cyber Defenses
In an alarming shift in tactics, ransomware gangs are increasingly resorting to real-world threats directed at business executives and their families to exert pressure during negotiations. This change comes as organizations have bolstered their cybersecurity measures and grown less inclined to meet extortion demands. A recent survey conducted by Semperis, an identity-centered cybersecurity vendor, sheds light on this disturbing trend, indicating the evolution of ransomware strategies in response to enhanced defenses against cybercrime.
Experts note that while the overall landscape of cyber resilience has improved, the criminals have had to adapt to maintain their influence. Simon Hodgkinson, a seasoned Chief Information Security Officer (CISO) and advisor to Semperis, remarked on the progress made in detection, protection, response, and recovery capabilities, stating, "We’ve still got a long way to go, but we’ve gotten better at those capabilities." He pointed out the troubling fact that while ransom payments remain high, the percentage of victims who pay has started to decline. The third annual ransomware risk report from Semperis reveals a drop in the number of organizations that capitulated to ransom demands, down to 59% this year from 69% the previous year and significantly from 78% in 2024.
With victims increasingly refusing to make payments, fueled by the availability of secure backups, criminals have reverted to older forms of intimidation. Hodgkinson noted this regression from a data-centric approach to a more "people-centric" crime, emphasizing that the pressure applied in negotiations is now rooted in fear. “They turn it back from a data-centric crime to a people-centric crime again, and the pressure point from a people perspective is fear, human fear,” he elaborated.
This trend represents a crucial third stage in the evolution of ransomware operations. Initially, hackers were able to encrypt data with minimal risk, exploiting weaknesses in organizations’ cybersecurity infrastructure. As companies adopted more resilient backup solutions to combat such attacks, ransomware operations diversified their tactics, employing "double extortion" by encrypting data and threatening to leak it publicly. However, as resilience measures continued to improve, these gangs have escalated their tactics by incorporating threats of physical violence into their campaigns.
Chris Inglis, a former U.S. National Cyber Director and a strategic advisor at Semperis, emphasized that this trend is a concerning development. He observed that the prevalence of holding individuals at physical risk is a new phenomenon, as most other risks have been extensively explored and covered by cybercriminals.
The Semperis report resonated with independent experts, many of whom attested to the growing importance of recognizing threats, although some cautioned against conflating threats of violence with actual assaults, which remain relatively rare. Tim Beasley, a Senior Incident Response Consultant at Semperis, recounted instances where high-ranking executives received unsettling threats via text messages, including images of their children’s school or their own vehicle’s license plate. For victims, such encounters can make the threats feel alarmingly real.
Beasley pointed out that while threats involving real-world harm are more common in Europe and the Middle East, they do occasionally occur in the Americas. He emphasized that doxxing—where personal information is made public online—and swatting—where false police reports are made to provoke an armed response—have increasingly emerged as common intimidation tactics. Despite the trend, he noted that actual violence stemming from these threats is comparatively rare.
The concept of "violence-as-a-service" further complicates this issue, highlighting how cybercriminals can facilitate physical assaults through local criminals, leading organizations to take these threats seriously. Matt Polak, CEO of VanishID, explained the transformative impact such threats can have on negotiations, emphasizing that negotiations can shift significantly when family members become involved, spotlighting personal concerns over corporate problems.
Moreover, personal threats can also serve as a pretext for technical penetration. In a notable case, Polak shared the story of a mid-level executive whose phone was compromised via malware that gathered sensitive information. The gang leveraged this information to attempt manipulating him into facilitating further access to corporate systems, underscoring the intersection of personal safety and cybersecurity risks.
Despite increasing instances of intimidation tactics, experts like Ian Gray, VP of intelligence for Flashpoint, stress the distinction between merely threatening someone and carrying out actual violence. The capability to intimidate remotely does not equate to an actor’s intention or capacity to inflict physical harm. Gray points out the necessity of thorough evaluations when assessing the credibility of threats, taking into consideration the actor’s history and prior behavioral patterns.
This evolving landscape of ransomware and associated threats illustrates a complex interplay of technological advancement, corporate resilience, and the unsettling emergence of human fear as a psychological weapon. As organizations continue to fortify their defenses against cybercrime, the need for robust strategies for mitigating personal threats and protecting individuals becomes increasingly urgent. The shift towards leveraging real-world intimidation as a means of coercion marks a significant escalation in the tactics employed by cybercriminals and highlights the pressing need for comprehensive measures to counteract this dangerous trend.