Threat reportRansomwareTL-2026-3467
Ransomware Actors Escalate to Personal Intimidation and Physical Threats Against Victim Staff (Semperis 2026 Ransomware Risk Report)
Ransomware Actors Escalate to Personal Intimidation and (TL-2026-3467), also tracked as Semperis 2026 Ransomware Risk Report, is a medium-severity ransomware operation, first published 2026-10-14. It is attributed to Scattered Spider with low confidence, affects Various Identity systems (Active Directory, Entra ID, Okta) and, maps to 13 MITRE ATT&CK techniques (T1078, T1136, T1199), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 3Scattered Spider
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-3467
- Threat ID
- TL-2026-3467
- Also known as
- Semperis 2026 Ransomware Risk Report, Ransomware personal intimidation trend
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Scattered Spider, ShinyHunters, LAPSUS
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all-sectors, executives, enterprise
- Target regions
- united states of america, united kingdom, france, germany, italy, spain, singapore, canada, australia
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Ransomware Actors Escalate to Personal Intimidation and
Malware and tooling: AveMaria/WarZone, Azorult, DragonForce, Lumma Stealer - S1213, Raccoon Stealer - S1148, RattyRAT, RedLine, ShinySp1d3r, Vidar, scattered lapsus$ hunters, AnyDesk, Mimikatz
How Ransomware Actors Escalate to Personal Intimidation and works
Semperis' 2026 ransomware report (published 2026-10-14) finds that a large share of ransomware attacks now include psychological or physical threats against victim staff and their families, including doxxing, swatting and threats of physical intrusion. The Register names Midnight Blizzard, Scattered Spider, ShinyHunters and Lapsus$ in this context; the latter three are publicly linked to the youth cybercrime network 'The Com'.
Semperis published its 2026 Ransomware Report on 2026-10-14, covering ransomware victims in the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia. The company's press release reports that 40% of attacks involved psychological or physical threats against staff, 87% of attacks weaponized AI, 87% targeted identity systems (Active Directory, Entra ID, Okta), 70% of victims were targeted multiple times and 31% paid more than once. Of victims who were threatened, 53% said the attackers followed through; 23% of victims or their families were swatted, 25% sought psychological or medical treatment, and 24% hired personal security.
The Register's coverage of the same report (Jessica Lyons, 2026-10-14) gives a slightly different headline figure, 37% of attacks with psychological or physical threats, and states that 1,200 post-ransomware organizations were surveyed. The Semperis press release excerpt does not state the sample size, and a search returned the '1,200 organizations' figure only as Semperis' customer count. Both the 37% vs 40% discrepancy and the sample size should be verified against the primary report. The Register lists threat forms reported by victims: threatening texts, letters or packages (57%), threats against family or friends (37%), physical intrusion (19%), abduction threats (17%), bodily harm threats (13%) and stalking (6%). It also cites doxxing (25%) and swatting (23%). Anecdotes include a package of Russian nesting dolls and regional gifts sent to Tim Beasley, and C-suite executives receiving pictures of their children's schools.
The Register names Midnight Blizzard (linked to Russia's SVR), Scattered Spider, ShinyHunters and Lapsus$. Per Europol-related reporting, Scattered Spider, Lapsus$ and ShinyHunters are believed to be associated with The Com, a youth cybercrime network based in the United States and United Kingdom. Europol's EU Internet Referral Unit and Spain's CITCO flagged 4,340 URLs tied to The Com during Referral Action Days in June-July 2026. The article does not state that Midnight Blizzard uses physical intimidation; no actor-specific attribution of the surveyed intimidation is made in the sources.
Technical tradecraft of the Com-linked actors is documented by CISA (AA23-320A, updated 2025-07-29): help-desk vishing and phishing/smishing, purchased credentials, abuse of trusted IT contractor relationships, MFA token registration, RMM tool deployment, federated IdP additions to SSO, new account creation, exfiltration to MEGA.NZ and Amazon S3, extortion without encryption, and DragonForce ransomware on ESXi. Resecurity (2025-09-25) adds SIM swapping, MFA push fatigue, infostealers (Lumma, Azorult, RedLine, Raccoon, Vidar), Salesforce OAuth token theft and the shinysp1d3r ransomware-as-a-service Telegram channel. This record is a trend/survey entry with no CVEs; the intimidation findings are secondary-source reporting. Defensive priority is identity-system resilience (dedicated identity backups, automated AD recovery), help-desk verification hardening, and executive/family protection and incident-response planning that anticipates personal coercion.
MITRE ATT&CK techniques used in TL-2026-3467
Initial Access
T1078 Valid Accounts; T1199 Trusted Relationship; T1566.004 Spearphishing Voice
Persistence
Collection
T1213 Data from Information Repositories
Command and Control
Privilege Escalation
Credential Access
T1528 Steal Application Access Token; T1556.006 Multi-Factor Authentication; T1621 Multi-Factor Authentication Request Generation
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Reconnaissance
Impact
Affected products and versions in Ransomware Actors Escalate to Personal Intimidation and
- Various — Identity systems (Active Directory, Entra ID, Okta) and organizations of all sectors
Vulnerable versions: Organizations without dedicated identity backups or automated recovery
Remediation for Ransomware Actors Escalate to Personal Intimidation and
Immediate actions
- Brief executives, their families and incident-response leads on intimidation, doxxing and swatting scenarios and establish a contact path to law enforcement
- Harden help-desk identity verification and require out-of-band approval for MFA resets and new MFA token registration
- Review and restrict unapproved remote-access (RMM) tools such as AnyDesk, ScreenConnect, Splashtop, TeamViewer, Ngrok and Tailscale
- Alert on new federated identity providers, new MFA registrations and bulk exports to MEGA.NZ or Amazon S3
Workarounds
- Do not engage or pay without legal, law-enforcement and incident-response guidance; the sources report 31% of victims paid more than once and 69-70% were targeted again within 12 months
Longer-term hardening
- Maintain dedicated identity-system backups and automate Active Directory / Entra ID recovery; include AD recovery in disaster-response plans
- Include personal-coercion and executive-protection scenarios in ransomware tabletop exercises
- Adopt phishing-resistant MFA and restrict OAuth connected-app tokens
- Reduce executives' and staff's exposed personal data to limit doxxing
Timeline of Ransomware Actors Escalate to Personal Intimidation and
- CISA and partners publish advisory AA23-320A documenting Scattered Spider help-desk social engineering, RMM abuse and data-theft extortion TTPs.
- CISA updates AA23-320A with new Scattered Spider TTPs including sophisticated social engineering and DragonForce ransomware deployment.
- Per Resecurity, in August 2025 a Telegram channel combines the Scattered Spider, LAPSUS$ and ShinyHunters brands and markets the 'shinysp1d3r' ransomware-as-a-service; Telegram later bans the channel (day of month not stated).
- Resecurity publishes 'Trinity of Chaos' analysis of the Scattered LAPSUS$ Hunters alliance, covering vishing, OAuth token theft and extortion tactics.
- Europol EU IRU and Spain's CITCO run Referral Action Days across nine countries during June-July 2026, flagging 4,340 URLs tied to The Com (month-level date).
- The Register publishes 'Ransomware gets personal', naming Midnight Blizzard, Scattered Spider, ShinyHunters and Lapsus$ and citing 37% of attacks with psychological or physical threats.
- Semperis publishes its 2026 Ransomware Report reporting AI weaponization and rising psychological and physical threats against victim staff and families.
Sources cited for Ransomware Actors Escalate to Personal Intimidation and
- Ransomware gets personal: 'We-know-where-you-are kind of stuff' (The Register)
- Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families
- CISA Advisory AA23-320A: Scattered Spider
- Trinity of Chaos: The LAPSUS$, ShinyHunters and Scattered Spider Alliance Embarks on Global Cybercrime Spree (Resecurity)
- Europol flags 4,340 URLs for removal in 'The Com' crackdown (BleepingComputer)
- Europol flags 4,340 URLs tied to Com network (GovInfoSecurity)
- Ransomware tactics now include physical coercion as gangs escalate pressure (TeissNews)
- Semperis reports escalating ransomware tactics, as physical threats and regulatory extortion rise (Industrial Cyber, prior-year report)
Detection coverage for TL-2026-3467
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3467 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.