Threat reportRansomwareTL-2026-3746
Ransomware Gangs Increasingly Use Threats of Physical Violence, Doxxing and Swatting to Extort Payments
Ransomware Gangs Increasingly Use Threats of Physical (TL-2026-3746), also tracked as Triple extortion, is a high-severity ransomware operation, first published 2026-10-16. It has no confirmed attribution, affects Various Organizations of all sizes experiencing ransomware (employees, maps to 7 MITRE ATT&CK techniques (T1078, T1111, T1566.004), and is covered by 9 detection rules and 8 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3746
- Threat ID
- TL-2026-3746
- Also known as
- Triple extortion, Physical-threat extortion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all sectors
- Target regions
- North America, Europe, united kingdom, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in Ransomware Gangs Increasingly Use Threats of Physical
Malware and tooling: telegram
How Ransomware Gangs Increasingly Use Threats of Physical works
The Semperis 2026 Ransomware Risk Report (1,200 post-ransomware IT/security respondents, released 2026-10-14) finds ransomware operators escalating extortion with psychological and physical threats against staff, including threatening messages and packages, threats to family, doxxing and swatting. The report is self-reported and uncorroborated, and named actors in related coverage include Scattered Spider, ShinyHunters and Lapsus$.
Semperis' 2026 Ransomware Risk Report, based on a survey of 1,200 IT and security professionals at organizations that experienced ransomware across North America, the UK, Europe and Asia-Pacific (fielded in the first half of 2026 and released 2026-10-14), describes a shift toward 'triple extortion': encryption ransom, data-breach/leak threats, and psychological or physical threats directed at staff. Infosecurity Magazine (2026-10-16) reports that 25% of ransomware campaigns involved such threats and also cites a 40% figure for attacks overall; The Register and Dark Reading-sourced coverage cite 37% (23% psychological intimidation, 17% physical threats). These headline figures differ between outlets and are not reconciled in the sources reviewed; treat them as approximate.
Reported intimidation tactics among affected organizations: threatening texts, letters or packages (57%); threats against family or friends (37%); physical intrusion into offices or homes (19%); abduction (17%); bodily harm (13%); stalking (6%). 25% reported staff being doxxed and 23% reported employees being swatted. 53% of victims said attackers followed through on threats, 25% of affected staff sought psychological or medical treatment, and 24% of organizations hired personal security teams. 69% of respondents were targeted multiple times within 12 months and 31% made multiple payments. Semperis' study relied on self-reporting and could not corroborate the figures; no confirmed violent attacks are documented in the sources.
The report names Scattered Spider, ShinyHunters, Lapsus$ and Midnight Blizzard (linked to Russia's SVR) in connection with intimidation behavior; a Semperis consultant described receiving nesting dolls and regional gifts from Midnight Blizzard and executives receiving photos of their children's schools. Separately, KrebsOnSecurity (2026-02-02), citing Unit 221B researcher Allison Nixon, documents the 'Scattered Lapsus ShinyHunters' (SLSH) playbook: voice phishing of employees impersonating IT staff to harvest SSO credentials and MFA codes, swatting of executives with phony bomb threats or hostage situations, harassment of executives' families and children, DDoS of victim sites, email flooding, notifying journalists and regulators, publishing victims on Telegram, and death threats against researchers and journalists. SLSH operates through ephemeral Telegram group chats and its members originate from 'The Com'. Unit 221B advises that victims not pay, since payment incentivizes escalation. Recommendations in the coverage: do not buckle under pressure, contact law enforcement promptly, and never pay.
This is a trend-level threat: no CVE, malware family, or network IOCs are published in the sources. Severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3746
Defense Evasion
T1078 Valid Accounts; T1684.001 Impersonation
Initial Access
T1078 Valid Accounts; T1566.004 Spearphishing Voice
Credential Access
T1111 Multi-Factor Authentication Interception
Reconnaissance
T1589 Gather Victim Identity Information; T1598.004 Spearphishing Voice
Impact
Affected products and versions in Ransomware Gangs Increasingly Use Threats of Physical
- Various — Organizations of all sizes experiencing ransomware (employees, executives and families targeted)
Remediation for Ransomware Gangs Increasingly Use Threats of Physical
Immediate actions
- Do not pay under intimidation; engage law enforcement promptly (per Semperis/Unit 221B guidance)
- Provide personal-security support and a point of contact for targeted staff and families
- Report swatting and threats to local police and notify them in advance of the risk to targeted executives
- Reset credentials and revoke SSO sessions for staff impersonated or phished via voice
Workarounds
- Enforce phishing-resistant MFA and help desk identity verification to blunt vishing-led intrusions
- Monitor Telegram and leak channels for victim, executive and family data postings
Longer-term hardening
- Add physical-threat and swatting scenarios to ransomware incident response playbooks
- Minimize executive and employee personal data exposure (data broker removal, home address privacy)
- Provide employee wellbeing and psychological support resources
- Train help desk and staff on voice-phishing and IT-impersonation social engineering
Timeline of Ransomware Gangs Increasingly Use Threats of Physical
- Early-to-mid January 2026: wave of SLSH extortion attacks involving vishing of employees, data theft and harassment/swatting of executives, as later summarized by KrebsOnSecurity (exact day not stated; mid-month used as approximation).
- Google Mandiant publishes a blog post on SLSH activity, referenced by KrebsOnSecurity.
- Unit 221B advises victims to refuse payment because engagement incentivizes further escalation.
- KrebsOnSecurity documents the Scattered Lapsus ShinyHunters playbook of harassing, threatening and swatting executives and families alongside voice phishing and Telegram-based extortion, citing Unit 221B's Allison Nixon.
- Semperis press release also reports 87% of ransomware attacks targeted identity systems (Active Directory, Entra ID, Okta), 84% weaponized AI, ~70% of victims were attacked multiple times and 31% paid more than once.
- Report finds ransomware victims reporting threatening messages/packages (57%), threats to family (37%), doxxing (25%) and swatting (23%); 53% say attackers followed through on threats.
- Semperis releases its 2026 Ransomware Risk Report, surveying 1,200 IT and security professionals in North America, the UK, Europe and Asia-Pacific.
- Infosecurity Magazine publishes coverage of the report describing 'triple extortion' with physical and psychological threats; other outlets note the data is self-reported and uncorroborated.
Sources cited for Ransomware Gangs Increasingly Use Threats of Physical
- Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (Infosecurity Magazine)
- Ransomware reports on physical threats and Semperis findings (The Register)
- Ransomware Gangs Embrace Physical Threats, Family Stalking? (Dark Reading)
- Ransomware actors reportedly escalating to physical threats and violence (SC World)
- Ransomware tactics now include physical coercion as gangs escalate pressure (teiss)
- Ransomware physical threats and violence (Bitdefender HotForSecurity)
- Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats (Semperis press release)
- Please Don't Feed the Scattered Lapsus ShinyHunters (KrebsOnSecurity)
Detection coverage for TL-2026-3746
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3746 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.