As ransomware gangs threaten physical harm, 'I am afraid of what's next,' ex-negotiator says
- Reference: 1753992310
- News link: https://www.theregister.co.uk/2025/07/31/ransomware_physical_harm_threats/
- Source link:
According to a [1]survey of 1,500 security and IT professionals conducted by Censuswide on behalf of security firm Semperis, digital intruders are still holding more traditional threats of system lockouts (52 percent) and data destruction (63 percent) over their victims' heads.
However, almost half (47 percent) of those surveyed across industries and geographies also reported that attackers have threatened to file regulatory complaints against them along the lines of [2]ALPHV's SEC complaint against fintech firm MeridianLink for failing to notify the American financial regulator of a significant security breach.
[3]
More worrisome, however, is that 40 percent of respondents reported [4]receiving physical threats from the miscreants.
[5]
[6]
"The threats of physical harm are pretty scary," Jeff Wichman, Semperis' director of breach preparedness and response, told The Register . "I am afraid of what's next."
Before leading the incident response team at Semperis, which specializes in preventing attacks against Active Directory, Wichman worked as a professional ransomware negotiator and saw extortionists call executives whose companies had been infected with data-locking malware.
[7]
"It was threats against their family members: what their [internet] surfing traffic was, what they did at home," Wichman said. "The attackers know where the executives live, they know where their families are, they know where their kids go to school."
The physical threats tend to be generic to ratchet up the fear-factor, he added. "If I tell you, 'I'm going to attack your kids at school,' you increase the security at school, whereas if I just say 'I'm gonna attack your family,' when we go to the grocery store, when we go to the movie theater, when we go to school, it makes it a little bit scarier. I don't think the attackers are going to tip their hand at what sort of violence — yet."
Wichman expects the threats to become more common and severe. "I would say in the next 12 months," he said. "Attackers will find any way feasible to force a payment."
[8]Ransomware crooks now SIM swap executives' kids to pressure their parents
[9]Clorox CISO flushes self after multimillion-dollar cyberattack
[10]Ransomware crews add 'EDR killers' to their arsenal – and some aren't even malware
[11]Ex-IDF cyber chief on Iran, Scattered Spider, and why social engineering worries him more than 0-days
Semperis' annual report paints a bleak picture of the state of ransomware attacks. The majority — 78 percent of respondents — were hit by a ransomware attack over the past 12 months, which is a slight decrease compared to last year's 83 percent.
Of those, 56 percent were successful ransomware infections. However, 73 percent of those victims suffered multiple attacks and 31 percent were attacked three or more times.
[12]
But despite this small drop in attacks, businesses took longer to recover from infections. Only 23 percent said they recovered within a day, compared to 39 percent last year. Meanwhile, 18 percent required between one week and one month, compared to 11 percent in 2024.
"I would attribute that to the attackers compromising the environment and damaging it sufficiently enough where an organization has to rebuild their environment, sometimes from backup and other times from a clean slate," Wichman said.
Plus, on average, 15 percent of victims who paid the ransom demand didn't receive usable decryption keys, and another 3 percent say their stolen data leaked anyway.
"I don't believe any organization should pay an attacker and think they are safe," Wichman said. "I've seen many examples where attackers state they're deleting the information and they never delete it. It's juicy information they can resell. Why wouldn't they take it and make more money?" ®
Get our [13]Tech Resources
[1] https://www.semperis.com/ransomware-risk-report/
[2] https://www.theregister.com/2023/11/16/clorox_ciso_washes_out/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aIvneAjFu5hWFzbG10kOgQAAAAA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2024/05/07/ransomware_evolves_from_mere_extortion/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIvneAjFu5hWFzbG10kOgQAAAAA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIvneAjFu5hWFzbG10kOgQAAAAA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aIvneAjFu5hWFzbG10kOgQAAAAA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2024/05/07/ransomware_evolves_from_mere_extortion/
[9] https://www.theregister.com/2023/11/16/clorox_ciso_washes_out/
[10] https://www.theregister.com/2025/03/31/ransomware_crews_edr_killers/
[11] https://www.theregister.com/2025/07/19/idf_cyber_chief_iran/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aIvneAjFu5hWFzbG10kOgQAAAAA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Re: Ransomware scum are weenies
I think they would do far worse. Find some junkie or such like and feed their habit making them dependent, then pointing them at the victim as the one person causing all their problems.
Re: Ransomware scum are weenies
They don't need to to it themselves, they just need to go to a darkweb site where they can find some gang members or mercenary types living in your country willing to do the violence in exchange for payment in cryptocurrency.
Of course at some point they'll realize they can get the same outcome without bothering with the ransomware, saving money they were using on buying exploits from the scumbags developing the 0 days. They skip the ransomware and go directly to the threats of physical harm. Next step would be the gang members they were subbing realizing they can collect all the money if they skip the former ransomware peddlers and make the threats themselves. That's the nice thing about criminals - you can always count on them to screw one another over.
Re: Ransomware scum are weenies
They don't need to to it themselves, they just need to go to a darkweb site where they can find some gang members or mercenary types living in your country willing to do the violence in exchange for payment in cryptocurrency.
Just like Ross Ulbricht did, and he was pardoned. So no real worries there.
Re: Ransomware scum are weenies
Easy to moralise when you’ve never been the target. Try reporting any kind of threat and see what happens. In most cases, police won’t act unless there’s actual violence. You’ll get a crime reference number, a vague “stay safe,” and that’s it.
Living under that kind of fear isn’t about lacking courage - it’s about recognising that no one’s coming to help. People yield because they’re isolated, terrified, and rightly sceptical of a system that repeatedly proves itself useless.
And let’s not pretend there’s some noble corporate cause to defend. After years of wage suppression, layoffs, “reorgs,” and being discarded to protect dividends, loyalty is dead. Ransomware gangs know it - they weaponise it.
I Read: a boon for people with goats that may be malicious or deceptive
I really should give myself time to wake up before hitting El Reg.
Ransomware scum are weenies
I would guess there's approximately 0% chance of them doing anything. If they had any spine, courage, or integrity they wouldn't be ransomware scum.