Threat reportRansomwareTL-2026-3672
Ransomware Extortion Escalates to Threats Against Employees and Their Families (Semperis 2026 Ransomware Risk Report)
Ransomware Extortion Escalates to Threats Against Employees (TL-2026-3672), also tracked as Semperis 2026 Ransomware Risk Report, is a high-severity ransomware operation, first published 2026-10-15. It has no confirmed attribution, affects Microsoft Active Directory, maps to 22 MITRE ATT&CK techniques (T1003.006, T1021.002, T1027), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 22MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-3672
- Threat ID
- TL-2026-3672
- Also known as
- Semperis 2026 Ransomware Risk Report, Personal-threat ransomware extortion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, logistics, real estate, health, energy, telecoms, agriculture, technology, finance
- Target regions
- North America, Europe, Asia-Pacific, Middle East
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Ransomware Extortion Escalates to Threats Against Employees
Malware and tooling: Agenda Ransomware, AgendaCrypt, Survey, payload, Mimikatz, PSEXEC
How Ransomware Extortion Escalates to Threats Against Employees works
Semperis' 2026 Ransomware Risk Report (1,200 IT/security professionals, 9 countries) finds ransomware crews increasingly threatening employees, executives and their families to force payment, with attackers following through in 53% of reported cases. The same report finds 87% of attacks targeted identity infrastructure (Active Directory, Entra ID, Okta) and that AI is widely used by attackers.
Semperis published its 2026 Ransomware Risk Report on 2026-10-14; Cyber Security News covered it on 2026-10-15. The survey covered 1,200 IT and security professionals from organizations hit by ransomware, across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia (8 sectors, first half of 2026). Figures differ between the two sources: Cyber Security News reports 37% of successful attacks included threats against workers' friends or relatives, while the Semperis release reports 40% of attacks involved psychological or physical threats against staff; likewise 84% (CSN) vs 87% (Semperis) for AI involvement.
Personal-pressure tactics reported by Cyber Security News: threatening texts, letters or packages (57%), threats of physical intrusion (19%), abduction (17%) and bodily harm (13%), doxxing of employees or family members (25%) and swatting (23%). Attackers carried out threatened actions in 53% of cases. Consequences: 25% of affected organizations said people needed medical or mental-health care, 24% hired personal security, and 14% saw staff or relatives change jobs, offices or homes. Attackers researched targets via social media and public records and used AI to personalize threat messages, research targets, modify malware and scale operations; 44% of cases involved criminals abusing the victim's own AI systems.
Identity infrastructure is the main attack surface: 87% of attacks targeted Active Directory, Entra ID or Okta (51% specifically Active Directory), and Semperis states nearly 75% of successful attacks targeted or exploited identity systems. Only 50% of organizations keep dedicated identity backups and 42% have automated identity recovery; 40% lack AD recovery procedures in disaster recovery plans. 59% of victims paid at least once and roughly 69-70% were successfully attacked multiple times.
Cyber Security News names two groups. Qilin reportedly abused Active Directory replication (DCSync) to collect domain credentials. Picus's Qilin analysis documents an embedded toolset: Mimikatz and PsExec v2.43 inside the locker, a payload staged as C:\temp\w.exe, the MaxMpxCt=65535 registry change before SMB lateral movement, -spread/-spread-process/-spread-vcenter arguments for self-distribution including VMware vCenter, PowerShell AD enumeration and log deletion, AES-256 CTR/ChaCha20/RSA-4096 cryptography, and historical initial access via external remote services, public-facing applications (e.g. Veeam CVE-2023-27532 credential retrieval) and malicious-file user execution; the Synnovis attack against London NHS hospitals (reported $50 million demand) is cited as a high-profile Qilin case.
PAYLOAD used Group Policy to disrupt Windows domains without file encryption: Kaspersky GERT (2026-09-21) described attackers who obtained administrator credentials (likely via phishing), used remote-access/VPN entry points to look like legitimate IT staff, and created a malicious GPO named 'PAYLOAD' that disabled local administrator accounts, pushed ransom notes and replaced wallpapers/lock screens across thousands of computers at a Middle East manufacturer, with stolen data published on the dark web. Separate SOC Prime analysis (2026-05-26) describes a PAYLOAD Windows locker (ChaCha20 per-file with Curve25519 ECDH, RC4-encrypted 56-byte footer, .payload extension, RECOVER_payload.txt note, MakeAmericaGreatAgain mutex, vssadmin shadow copy deletion, taskkill/service stops, ETW patching, event log clearing via wevtapi.dll, Tor leak/negotiation sites) targeting logistics, real estate and manufacturing organizations. Neither the Semperis release nor the CSN article provides network IOCs or CVEs for this report's campaign; the Semperis release names no actors. IOCs below are family-level artifacts from the cited vendor analyses.
MITRE ATT&CK techniques used in TL-2026-3672
Credential Access
T1003.006 OS Credential Dumping: DCSync
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1564.012 Hide Artifacts: File/Path Exclusions
Execution
T1059 Command and Scripting Interpreter; T1204.002 User Execution: Malicious File
Initial Access
T1078.002 Valid Accounts: Domain Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing
Discovery
T1087.002 Account Discovery: Domain Account
Privilege Escalation
T1134 Access Token Manipulation
defense-impairment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1531 Account Access Removal; T1657 Financial Theft
Reconnaissance
T1589 Gather Victim Identity Information; T1593.001 Search Open Websites/Domains: Social Media
Affected products and versions in Ransomware Extortion Escalates to Threats Against Employees
- Microsoft — Active Directory
Vulnerable versions: Environments without dedicated identity backup or recovery - Microsoft — Entra ID
Vulnerable versions: Environments without dedicated identity backup or recovery - Okta — Okta identity platform
Vulnerable versions: Environments without dedicated identity backup or recovery
Remediation for Ransomware Extortion Escalates to Threats Against Employees
Immediate actions
- Establish trusted out-of-band communication channels outside corporate email/chat for use during an incident
- Enforce MFA and limit privileged access on Active Directory, Entra ID and Okta administrative accounts
- Monitor domain controllers for directory replication requests from non-DC hosts and for new or modified Group Policy Objects
- Audit VPN/remote-access logins by administrator accounts for anomalous source, time and behavior
- Provide employees a blame-free channel to report threats against themselves or family
Workarounds
- Restrict who can edit GPOs and alert on GPO changes that disable local administrator accounts or push wallpaper/ransom-note settings
Longer-term hardening
- Maintain tested offline backups and dedicated identity backups with a clean-room AD/Entra recovery procedure
- Automate identity service recovery and include AD recovery in disaster recovery plans
- Run tabletop exercises that include doxxing, swatting and family-threat scenarios
- Offer counseling, privacy checks and personal security support to affected staff and executives
Timeline of Ransomware Extortion Escalates to Threats Against Employees
- Qilin ransomware (originally Agenda) emerges as a RaaS operation (July 2022 per vendor reporting)
- PAYLOAD ransomware group first observed (February 2026 per SOC Prime), later linked to logistics, real estate and manufacturing victims
- SOC Prime publishes in-depth technical analysis of the PAYLOAD Windows locker (ChaCha20/Curve25519, .payload extension, RECOVER_payload.txt, MakeAmericaGreatAgain mutex)
- First half of 2026 closes: the survey window for Semperis' 1,200 respondents from ransomware-hit organizations in nine countries
- Kaspersky GERT publishes a PAYLOAD case at a Middle East manufacturer: encryptionless extortion via a malicious Group Policy Object that disabled local admin accounts and pushed ransom notes
- Semperis releases its 2026 Ransomware Risk Report: rise in AI-driven attacks and physical threats against executives and their families
- Cyber Security News publishes coverage naming Qilin (AD replication credential theft) and PAYLOAD (Group Policy disruption) alongside the survey statistics
Sources cited for Ransomware Extortion Escalates to Threats Against Employees
- Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families (Cyber Security News)
- Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families
- Semperis Ransomware Risk Report 2026
- Kaspersky uncovers new PAYLOAD, the stealth ransomware that hijacks corporate devices without encrypting files
- PAYLOAD Ransomware: In-Depth Technical Analysis (SOC Prime)
- Qilin Ransomware Analysis: Critical TTPs and Defense (Picus Security)
- Qilin Ransomware: Attack Methods and 2026 Status (CybelAngel)
Detection coverage for TL-2026-3672
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3672 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.