A recent survey by Semperis found that 37% of ransomware incidents now include psychological or physical threats directed at employees or their families. Tim Beasley, a senior incident response consultant at Semperis and former lead investigator for Microsoft’s Detection and Response Team, described receiving a package containing nesting dolls and regional gifts during an investigation into an attack attributed to Russia’s Midnight Blizzard group. The items, which he characterized as “we-know-where-you-are kind of stuff,” exemplified a growing tactic of blending digital extortion with real-world intimidation.

The study, which analyzed 1,200 organizations globally between January and June, documented a rise in tactics that extend beyond data encryption. Thirty-seven percent of attacks involved threats of violence, family harm, or public exposure of personal information. Twenty-five percent of victims reported doxxing, while 24% hired private security and 23% experienced swatting incidents — false emergency reports designed to provoke armed responses. Over half of respondents confirmed attackers followed through on threats within the past year, including direct contact via texts or letters (57%), physical intrusions (19%), and abductions (17%).

Beasley noted that organized cybercriminal groups such as Scattered Spider, ShinyHunters, and Lapsus$ have adopted these methods to increase pressure on victims. While some groups deny targeting individuals, others acknowledge using aggressive tactics to compel payment. The report also found that 69% of victims faced repeat attacks within a year, and 31% paid multiple ransoms. Beasley emphasized that paying ransoms often encourages further targeting, stating, “Don’t pay anything. Never pay them.” Law enforcement involvement was recommended for organizations facing credible threats, with guidance to preserve evidence and avoid capitulation under duress.

The findings reflect a broader shift in cybercrime, where digital threats increasingly intersect with real-world harm. While the survey did not name specific victims or confirm direct state sponsorship in the nesting doll incident, it underscores the evolving risks faced by enterprises and the need for proactive security strategies.