Europol flags 4,340 URLs as ransomware gangs escalate attacks with threats against families

A global survey indicates that 37% of ransomware attacks now involve psychological or physical threats against victims, according to The Register. This finding highlights a significant shift in extortion tactics, where cybercriminals leverage real-world harm to compel payment. The data suggests that digital intrusions are increasingly crossing into physical intimidation.

The survey results underscore a growing trend where attackers move beyond simple data encryption. They now employ mental and physical trauma as leverage. This escalation forces victims to pay extortion demands under the threat of direct harm. The prevalence of such tactics has risen over the last several years, becoming almost common in the industry.

Escalation of Threat Tactics

Tim Beasley, a senior incident response consultant at Semperis, described receiving a package containing nesting dolls and regional gifts while investigating an attack by Russia’s Midnight Blizzard. At the time, Beasley served as lead investigator for Microsoft’s Detection and Response Team (DART). He assumed the unmarked package was from the group, which is linked to the Kremlin’s Foreign Intelligence Service (SVR).

Beasley characterized the items as "we-know-where-you-are kind of stuff" to The Register. He noted that such deliveries serve as a stark eye-opener for security professionals. This physical manifestation of a digital threat illustrates how attackers blur the lines between cybercrime and real-life harassment. The absence of a note added to the psychological pressure on the investigator.

Targeting Families and Executives

Attackers use social media reconnaissance to gather personal details about victims. Beasley reported investigating cases where C-suite executives received pictures of their children’s schools directly from cybercriminals. These images were intended to apply psychological pressure to secure the extortion fee. The targeting of family members and personal spaces represents a severe escalation in ransomware operations.

The Register reported that this type of psychological intimidation against employees has seen an uptick. Beasley stated that investigators have seen threats involving people's families. This normalization of personal harassment reflects a broader trend where cybercrime acts as a gateway to real-life violence. Some groups explicitly use digital access to facilitate physical harm.

What should you do?

Security teams must recognize that ransomware incidents can have physical consequences. Organizations should prepare for the possibility of targeted harassment against staff. Incident response plans should include protocols for handling personal threats. Monitoring social media for reconnaissance attempts is also critical.

What to do and how to stay safe: ransomware

• Audit executive and employee social media profiles to limit publicly available personal information.
• Develop incident response protocols that address physical threats and harassment of staff members.
• Monitor communication channels for signs of social engineering or reconnaissance targeting families.
• Coordinate with local law enforcement if physical threats or suspicious packages are received.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What percentage of ransomware attacks involve personal threats?

According to a global survey reported by The Register, 37% of ransomware attacks involve psychological or physical threats.

How do attackers gather information for these threats?

Attackers use social media reconnaissance to find details about victims, including their families and children's schools.

What actions has Europol taken regarding online violence?

Over the summer, Europol and partners flagged 4,340 URLs for removal related to The Com, a network involved in illicit activities.