# Ransomware Gangs Escalate to Personal Threats Against Employees and Families; Identity Infrastructure (AD/Entra ID/Okta) Targeted

> Semperis' 2026 Ransomware Risk Report (published 2026-10-14; 1,200 IT/security professionals at ransomware-victim organizations, 9 countries, 8 sectors) finds 37% of victims faced threats against workers' friends or relatives, 53% of whom saw threats carried out, and 87% of attacks targeted Active Directory, Entra ID or Okta. Qilin (AD replication credential theft) and PAYLOAD (encryptionless Group Policy abuse) are cited as identity-centric examples.

- **Published:** 2026-10-16T00:22:45Z
- **Last reviewed:** 2026-10-16T00:22:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3682
- **ID:** TL-2026-3682
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Semperis' 2026 Ransomware Risk Report, released 2026-10-14 and covered by Cyber Security News on 2026-10-15, surveyed 1,200 IT and security professionals across nine countries and eight sectors; respondents were limited to organizations that had been victimized by ransomware in the prior 12 months. It documents two converging escalations in ransomware operations: personal coercion of people and systematic targeting of identity infrastructure.

Coercion: 37% of successful attacks included threats against workers' friends or relatives, and 53% of victims reported attackers followed through. Reported forms include threatening texts, letters or packages (57%), threats of physical intrusion (19%), abduction (17%) and bodily harm (13%), plus doxxing (25%) and swatting (reported as 23-25% across coverage of the report). Human impact is significant: 25% of victims or family members needed medical or mental-health care, 24% hired personal security, and 14% changed jobs, offices or homes. Attackers research targets on social media to identify relatives. 59% of victims paid at least once and 69-70% were attacked multiple times.

Identity targeting: 87% of attacks targeted Active Directory, Entra ID or Okta (51% Active Directory specifically). Only 50% of organizations had dedicated identity backups and 42% automated identity recovery; Semperis also reports ~60% of disaster-recovery plans lack identity recovery procedures. The article cites Qilin abusing Active Directory replication (DCSync-style) to harvest domain credentials, and PAYLOAD using Group Policy to disrupt Windows domains without encrypting files. Kaspersky GERT's analysis of a PAYLOAD intrusion at a Middle East manufacturer describes: initial access 2026-04-11 via a compromised domain account over FortiGate SSL VPN; domain-admin-equivalent privileges by 2026-04-13; a malicious GPO named PAYLOAD linked at the domain root (distributing README-payload.txt, replacing wallpaper/lock screen with payload.jpg, showing a login ransom message, disabling the built-in local administrator) and a second GPO 'win Firewall Off' disabling Windows Firewall on domain/private/public profiles; policies took effect as hosts rebooted on 2026-04-14. No malicious executables or encryption were found, and data was exfiltrated from file servers.

AI: 84% of victims experienced AI-assisted attacks (e.g., convincing messages, target research, malware modification) and 44% reported criminals abusing the victim's own AI systems. Note: the headline statistics are survey-derived and vendor-reported; no CVEs, network IOCs or file hashes are given in the primary sources. Defensive priorities are identity-plane hardening and recovery (tiered admin, MFA, GPO change monitoring, DCSync detection, tested identity backups), plus incident-response plans that cover threats to people (out-of-band communications, doxxing/swatting exercises, law-enforcement/CISA reporting).

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1566 Phishing
- T1589 Gather Victim Identity Information
- T1593 Search Open Websites/Domains
- T1003.006 DCSync
- T1087.002 Domain Account
- T1021.002 SMB/Windows Admin Shares
- T1484.001 Group Policy Modification
- T1686 Disable or Modify System Firewall
- T1685 Disable or Modify Tools
- T1219 Remote Access Tools
- T1531 Account Access Removal
- T1491.001 Internal Defacement
- T1490 Inhibit System Recovery
- T1657 Financial Theft

## Sources

- [Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their Families (Cyber Security News)](https://cybersecuritynews.com/ransomware-attacks-get-personal/)
- [Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families](https://www.semperis.com/press-release/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families/)
- [Semperis 2026 Ransomware Report (PR Newswire)](http://www.prnewswire.com/news-releases/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families-302907731.html)
- [Kaspersky uncovers new PAYLOAD: the stealth ransomware that hijacks corporate devices without encrypting files](https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-new-payload-the-stealth-ransomware-that-hijacks-corporate-devices-without-encrypting-files)
- [PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks (CyberInsider)](https://cyberinsider.com/payload-ransomware-hijacks-windows-group-policy-in-encryption-less-attacks/)
- [Qilin ransomware: Attack Chain, MITRE ATT&CK TTPs, and Incident Response Guide (ProvenData)](https://www.provendata.com/blog/qilin-ransomware)
- [Semperis finds 44% of surveyed ransomware victims said their own AI was exploited](https://superpowerdaily.com/posts/semperis-finds-44-of-surveyed-ransomware-victims-said-their-own-ai-was-exploited)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3682