# Ransomware Gangs Increasingly Use Threats of Physical Violence, Doxxing and Swatting to Extort Payments

> The Semperis 2026 Ransomware Risk Report (1,200 post-ransomware IT/security respondents, released 2026-10-14) finds ransomware operators escalating extortion with psychological and physical threats against staff, including threatening messages and packages, threats to family, doxxing and swatting. The report is self-reported and uncorroborated, and named actors in related coverage include Scattered Spider, ShinyHunters and Lapsus$.

- **Published:** 2026-10-16T13:52:09Z
- **Last reviewed:** 2026-10-16T13:52:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3746
- **ID:** TL-2026-3746
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Semperis' 2026 Ransomware Risk Report, based on a survey of 1,200 IT and security professionals at organizations that experienced ransomware across North America, the UK, Europe and Asia-Pacific (fielded in the first half of 2026 and released 2026-10-14), describes a shift toward 'triple extortion': encryption ransom, data-breach/leak threats, and psychological or physical threats directed at staff. Infosecurity Magazine (2026-10-16) reports that 25% of ransomware campaigns involved such threats and also cites a 40% figure for attacks overall; The Register and Dark Reading-sourced coverage cite 37% (23% psychological intimidation, 17% physical threats). These headline figures differ between outlets and are not reconciled in the sources reviewed; treat them as approximate.

Reported intimidation tactics among affected organizations: threatening texts, letters or packages (57%); threats against family or friends (37%); physical intrusion into offices or homes (19%); abduction (17%); bodily harm (13%); stalking (6%). 25% reported staff being doxxed and 23% reported employees being swatted. 53% of victims said attackers followed through on threats, 25% of affected staff sought psychological or medical treatment, and 24% of organizations hired personal security teams. 69% of respondents were targeted multiple times within 12 months and 31% made multiple payments. Semperis' study relied on self-reporting and could not corroborate the figures; no confirmed violent attacks are documented in the sources.

The report names Scattered Spider, ShinyHunters, Lapsus$ and Midnight Blizzard (linked to Russia's SVR) in connection with intimidation behavior; a Semperis consultant described receiving nesting dolls and regional gifts from Midnight Blizzard and executives receiving photos of their children's schools. Separately, KrebsOnSecurity (2026-02-02), citing Unit 221B researcher Allison Nixon, documents the 'Scattered Lapsus ShinyHunters' (SLSH) playbook: voice phishing of employees impersonating IT staff to harvest SSO credentials and MFA codes, swatting of executives with phony bomb threats or hostage situations, harassment of executives' families and children, DDoS of victim sites, email flooding, notifying journalists and regulators, publishing victims on Telegram, and death threats against researchers and journalists. SLSH operates through ephemeral Telegram group chats and its members originate from 'The Com'. Unit 221B advises that victims not pay, since payment incentivizes escalation. Recommendations in the coverage: do not buckle under pressure, contact law enforcement promptly, and never pay.

This is a trend-level threat: no CVE, malware family, or network IOCs are published in the sources. Severity is analyst-assigned.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1566.004 Spearphishing Voice
- T1111 Multi-Factor Authentication Interception
- T1078 Valid Accounts
- T1657 Financial Theft
- T1598.004 Spearphishing Voice
- T1684.001 Impersonation
- T1078 Valid Accounts

## Sources

- [Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/ransomware-threats-physical/)
- [Ransomware reports on physical threats and Semperis findings (The Register)](https://www.theregister.com/a/5302939)
- [Ransomware Gangs Embrace Physical Threats, Family Stalking? (Dark Reading)](https://darkreading.com/cybersecurity-analytics/ransomware-gangs-physical-threats-family-stalking)
- [Ransomware actors reportedly escalating to physical threats and violence (SC World)](https://www.scworld.com/brief/ransomware-actors-reportedly-escalating-to-physical-threats-and-violence)
- [Ransomware tactics now include physical coercion as gangs escalate pressure (teiss)](https://www.teiss.co.uk/news/ransomware-tactics-now-include-physical-coercion-as-gangs-escalate-pressure-16181)
- [Ransomware physical threats and violence (Bitdefender HotForSecurity)](https://www.bitdefender.com/en-au/blog/hotforsecurity/ransomware-physical-threats-violence)
- [Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats (Semperis press release)](https://www.semperis.com/press-release/semperis-2026-ransomware-report-reveals-increases-in-ai-driven-attacks-and-a-rise-in-physical-threats-against-executives-and-their-families/)
- [Please Don't Feed the Scattered Lapsus ShinyHunters (KrebsOnSecurity)](https://krebsonsecurity.com/?p=73145)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3746