Ransomware gangs shift to physical intimidation and AI-driven strikes

The study, which surveyed victims across nine countries, reveals that 40% of recent ransomware incidents involved psychological or physical intimidation. In 53% of those instances, hackers followed through on their threats, forcing a quarter of victims to seek medical or psychological treatment. Chris Inglis, former U.S. National Cyber Director, noted that attackers are escalating these tactics because previous methods of digital extortion have become less effective as companies improve their data backup resilience.

Identity infrastructure remains the primary target for these operations, with 87% of attacks aiming to compromise systems like Active Directory, Entra ID, and Okta. Despite this, roughly half of the organizations surveyed lack dedicated identity backups or automated recovery procedures. This vulnerability is compounded by the fact that 70% of victims are targeted multiple times, with nearly a third paying ransoms on more than one occasion.

The human cost of these breaches is equally severe. Security professionals are facing burnout and high turnover as they manage the mounting pressure of these sophisticated threats. Semperis CEO Mickey Bresman emphasized that as organizations harden their defenses against encryption, attackers are continuously refining their methods to find new ways to extract payments, leaving companies in a constant cycle of crisis management.