Threat reportRansomwareTL-2026-3857
Ransomware Pressure Extends to Employees' Homes and Families: Doxxing, Swatting and Physical Intimidation (Semperis 2026 Ransomware Risk Report)
Ransomware Pressure Extends to Employees' Homes and Families (TL-2026-3857), also tracked as Semperis 2026 Ransomware Risk Report, is a medium-severity ransomware operation, first published 2026-10-19. It has no confirmed attribution, affects Microsoft Active Directory / Entra ID, maps to 7 MITRE ATT&CK techniques (T1078, T1078.002, T1078.004), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-3857
- Threat ID
- TL-2026-3857
- Also known as
- Semperis 2026 Ransomware Risk Report, Ransomware personal-intimidation escalation
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, health, manufacturing, critical infrastructure, government administration
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in Ransomware Pressure Extends to Employees' Homes and Families
Malware and tooling: Survey
How Ransomware Pressure Extends to Employees' Homes and Families works
Semperis' 2026 Ransomware Risk Report (1,200 IT/security professionals at ransomware-affected organizations) finds extortion pressure now reaches employees' families and homes through threats, doxxing, stalking and swatting. 69% of victims were hit multiple times in 12 months and 87% had identity systems (Active Directory, Entra ID, Okta) targeted or exploited.
This entry documents a survey-based trend report, not a single campaign or vulnerability. Semperis published its third annual Ransomware Risk Report on 2026-10-14. It is based on a survey of 1,200 IT and security professionals at organizations that had suffered at least one successful ransomware attack. Coverage describes fieldwork in the first half of 2026 across nine countries (U.S., UK, France, Germany, Italy, Spain, Singapore, Canada, Australia) and eight sectors, including finance, healthcare, manufacturing, critical infrastructure and government.
The central finding is that extortion has moved beyond encryption and data-leak threats ('double extortion') to add psychological and physical intimidation of staff, executives and their families ('triple extortion' in Infosecurity Magazine's wording). Reported figures vary slightly by outlet: 37% of respondents said employees' family or friends were threatened; 25% reported doxxing; 23% (24% in the Semperis press release) reported swatting; and 25% said employees or family members needed medical or psychological treatment. Other figures: 24% hired personal security, 14% said staff changed jobs or relocated, and 40-41% reported physical or psychological intimidation overall. Threat types reported include threatening texts, letters or packages (57%), physical intrusion (19%), abduction (17%), bodily harm (13%) and stalking (6%). 53% of respondents said attackers followed through on threats in the past year. The Register notes that the data is self-reported and could not be independently corroborated.
The report also quantifies the technical context. 69% of organizations suffered multiple successful ransomware attacks in the past year and 31% made multiple ransom payments. 59% paid a ransom (down from 69% the prior year and 78% in 2024). 87% reported attacks that targeted or exploited identity infrastructure such as Active Directory, Microsoft Entra ID and Okta. Only about 50% have dedicated identity backups, fewer than 50% automate identity recovery, and about 60% of disaster recovery plans lack identity-system recovery procedures. 84% reported attacker use of AI and 44% reported manipulation of their own AI agents or systems (CSO Online). Help Net Security also notes attackers leaving backdoors and compromised accounts for re-entry.
The sources name no CVEs, malware families or network indicators for this finding. The Register mentions Scattered Spider, ShinyHunters, Lapsus$ and Midnight Blizzard as context for personal-intimidation tactics; it does not make the survey statistics attributable to any of them. Defenders should treat this as a risk-posture and preparedness input: identity-tier hardening and recovery, employee and family safety reporting channels, and incident-response planning that covers personal-targeting scenarios.
MITRE ATT&CK techniques used in TL-2026-3857
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
T1078.002 Valid Accounts: Domain Accounts; T1078.004 Valid Accounts: Cloud Accounts
Privilege Escalation
T1078.002 Valid Accounts: Domain Accounts
Exfiltration
T1567 Exfiltration Over Web Service
Reconnaissance
T1589 Gather Victim Identity Information
Impact
Affected products and versions in Ransomware Pressure Extends to Employees' Homes and Families
- Microsoft — Active Directory / Entra ID
Vulnerable versions: Identity systems reported as targeted or exploited in 87% of surveyed attacks; no specific vulnerable versions stated - Okta — Okta identity platform
Vulnerable versions: Identity systems reported as targeted or exploited in 87% of surveyed attacks; no specific vulnerable versions stated
Remediation for Ransomware Pressure Extends to Employees' Homes and Families
Immediate actions
- Establish a confidential channel for employees to report threats against themselves or their families, with escalation to legal, HR and law enforcement
- Review privileged identity accounts (Active Directory, Entra ID, Okta) for unexpected creation, role changes and persistence, and rotate credentials after any intrusion
- Confirm identity-system backups exist, are isolated, and have a tested restore path
Workarounds
- After an incident, hunt for backdoors and leftover compromised accounts that would let the attacker re-enter
- Reduce the personal information about staff and executives that is publicly available
Longer-term hardening
- Require phishing-resistant MFA for privileged accounts and apply least privilege
- Add identity-system recovery to disaster recovery plans and run tabletop exercises simulating a compromised identity tier
- Limit AI agent permissions, assign owners, and require human approval for high-impact AI actions
- Prepare an executive and staff protection plan, including guidance on doxxing exposure and swatting response
Timeline of Ransomware Pressure Extends to Employees' Homes and Families
- Summer 2025: Europol and partners flag 4,340 URLs for removal tied to 'The Com' network, whose young members engage in hacking, swatting, digital extortion and physical violence (context cited by The Register)
- First half of 2026: Semperis survey fieldwork period begins (1,200 IT and security professionals at ransomware-affected organizations in nine countries)
- The Register publishes 'Ransomware Gets Personal', noting the figures are self-reported and naming Scattered Spider, ShinyHunters, Lapsus$ and Midnight Blizzard as context
- Semperis publishes its third annual 2026 Ransomware Risk Report and press release on AI-driven attacks and physical threats against executives and families
- CSO Online reports 84% of victims faced AI-involved attacks, 44% saw manipulation of their own AI agents or systems, and 87% had identity infrastructure targeted
- Infosecurity Magazine reports on ransomware gangs using threats of physical violence, framing it as triple extortion
- Help Net Security reports the survey findings on threats against employees' family and friends, swatting, doxxing and identity-system targeting
Sources cited for Ransomware Pressure Extends to Employees' Homes and Families
- Ransomware pressure now reaches employees' homes and families (Help Net Security)
- Semperis Ransomware Risk Report
- Semperis 2026 Ransomware Report Reveals Increases in AI-Driven Attacks and a Rise in Physical Threats Against Executives and Their Families
- Ransomware Gets Personal (The Register)
- Ransomware Gangs Increasingly Turn to Threats of Physical Violence to Extort Payments (Infosecurity Magazine)
- Ransomware extortion gets personal as attackers target employees' families (CSO Online)
- Ransomware Gangs Embrace Physical Threats, Family Stalking? (Dark Reading)
Detection coverage for TL-2026-3857
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3857 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.