# Ransomware Extortion Escalates to Threats Against Employees and Their Families (Semperis 2026 Ransomware Risk Report)

> Semperis' 2026 Ransomware Risk Report (1,200 IT/security professionals, 9 countries) finds ransomware crews increasingly threatening employees, executives and their families to force payment, with attackers following through in 53% of reported cases. The same report finds 87% of attacks targeted identity infrastructure (Active Directory, Entra ID, Okta) and that AI is widely used by attackers.

- **Published:** 2026-10-15T22:19:11Z
- **Last reviewed:** 2026-10-15T22:19:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3672
- **ID:** TL-2026-3672
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Semperis published its 2026 Ransomware Risk Report on 2026-10-14; Cyber Security News covered it on 2026-10-15. The survey covered 1,200 IT and security professionals from organizations hit by ransomware, across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia (8 sectors, first half of 2026). Figures differ between the two sources: Cyber Security News reports 37% of successful attacks included threats against workers' friends or relatives, while the Semperis release reports 40% of attacks involved psychological or physical threats against staff; likewise 84% (CSN) vs 87% (Semperis) for AI involvement.

Personal-pressure tactics reported by Cyber Security News: threatening texts, letters or packages (57%), threats of physical intrusion (19%), abduction (17%) and bodily harm (13%), doxxing of employees or family members (25%) and swatting (23%). Attackers carried out threatened actions in 53% of cases. Consequences: 25% of affected organizations said people needed medical or mental-health care, 24% hired personal security, and 14% saw staff or relatives change jobs, offices or homes. Attackers researched targets via social media and public records and used AI to personalize threat messages, research targets, modify malware and scale operations; 44% of cases involved criminals abusing the victim's own AI systems.

Identity infrastructure is the main attack surface: 87% of attacks targeted Active Directory, Entra ID or Okta (51% specifically Active Directory), and Semperis states nearly 75% of successful attacks targeted or exploited identity systems. Only 50% of organizations keep dedicated identity backups and 42% have automated identity recovery; 40% lack AD recovery procedures in disaster recovery plans. 59% of victims paid at least once and roughly 69-70% were successfully attacked multiple times.

Cyber Security News names two groups. Qilin reportedly abused Active Directory replication (DCSync) to collect domain credentials. Picus's Qilin analysis documents an embedded toolset: Mimikatz and PsExec v2.43 inside the locker, a payload staged as C:\temp\w.exe, the MaxMpxCt=65535 registry change before SMB lateral movement, -spread/-spread-process/-spread-vcenter arguments for self-distribution including VMware vCenter, PowerShell AD enumeration and log deletion, AES-256 CTR/ChaCha20/RSA-4096 cryptography, and historical initial access via external remote services, public-facing applications (e.g. Veeam CVE-2023-27532 credential retrieval) and malicious-file user execution; the Synnovis attack against London NHS hospitals (reported $50 million demand) is cited as a high-profile Qilin case.

PAYLOAD used Group Policy to disrupt Windows domains without file encryption: Kaspersky GERT (2026-09-21) described attackers who obtained administrator credentials (likely via phishing), used remote-access/VPN entry points to look like legitimate IT staff, and created a malicious GPO named 'PAYLOAD' that disabled local administrator accounts, pushed ransom notes and replaced wallpapers/lock screens across thousands of computers at a Middle East manufacturer, with stolen data published on the dark web. Separate SOC Prime analysis (2026-05-26) describes a PAYLOAD Windows locker (ChaCha20 per-file with Curve25519 ECDH, RC4-encrypted 56-byte footer, .payload extension, RECOVER_payload.txt note, MakeAmericaGreatAgain mutex, vssadmin shadow copy deletion, taskkill/service stops, ETW patching, event log clearing via wevtapi.dll, Tor leak/negotiation sites) targeting logistics, real estate and manufacturing organizations. Neither the Semperis release nor the CSN article provides network IOCs or CVEs for this report's campaign; the Semperis release names no actors. IOCs below are family-level artifacts from the cited vendor analyses.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1593.001 Search Open Websites/Domains: Social Media
- T1566 Phishing
- T1078.002 Valid Accounts: Domain Accounts
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1204.002 User Execution: Malicious File
- T1059 Command and Scripting Interpreter
- T1134 Access Token Manipulation
- T1003.006 OS Credential Dumping: DCSync
- T1087.002 Account Discovery: Domain Account
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1685.005 Clear Windows Event Logs
- T1685 Disable or Modify Tools
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1564.012 Hide Artifacts: File/Path Exclusions
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1531 Account Access Removal
- T1529 System Shutdown/Reboot
- T1657 Financial Theft

## Sources

- [Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families (Cyber Security News)](https://cybersecuritynews.com/ransomware-attacks-get-personal/)
- [Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families](http://www.prnewswire.com/news-releases/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families-302907731.html)
- [Semperis Ransomware Risk Report 2026](https://www.semperis.com/ransomware-risk-report/)
- [Kaspersky uncovers new PAYLOAD, the stealth ransomware that hijacks corporate devices without encrypting files](https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-new-payload-the-stealth-ransomware-that-hijacks-corporate-devices-without-encrypting-files)
- [PAYLOAD Ransomware: In-Depth Technical Analysis (SOC Prime)](https://socprime.com/active-threats/payload-ransomware-in-depth-technical-analysis/)
- [Qilin Ransomware Analysis: Critical TTPs and Defense (Picus Security)](https://www.picussecurity.com/resource/blog/qilin-ransomware)
- [Qilin Ransomware: Attack Methods and 2026 Status (CybelAngel)](https://cybelangel.com/blog/qilin-ransomware-tactics-attack/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3672