Semperis公司的高级事件响应顾问蒂姆·比斯利（Tim Beasley）在调查一起涉及俄罗斯“午夜暴雪”（Midnight Blizzard）组织的网路攻击时，家门口突然出现了一个包裹，里面装着套娃和其他该地区的礼品。当时，比斯利担任微软检测与响应团队（DART）的首席调查员。他推测这些东西来自该组织，该组织与克里姆林宫的对外情报局（SVR）有关联，尽管寄件人没有留下字条。
Tim Beasley, a senior incident response consultant at Semperis, was investigating a cyberattack involving Russia’s Midnight Blizzard when a package containing nesting dolls and other regional gifts showed up on his doorstep. At the time, Beasley served as the lead investigator for Microsoft’s Detection and Response Team (DART). He assumed it was from the group, which has been linked to the Kremlin’s Foreign Intelligence Service (SVR), although the sender didn’t leave a note.
“就是一些来自世界那个地区的小纪念品和礼品篮里的东西，”他告诉《The》。“就是那种‘我们知道你在哪’之类的东西。当你收到这种东西时，真的会大开眼界。”
“Just little souvenirs and gift basket stuff from that area of the world,” he told The. “We-know-where-you-are kind of stuff. It’s a real eye-opener when you get that type of thing.”
虽然数字入侵产生现实后果并非新鲜事，但近年来网络犯罪分子已转向利用现实生活中的伤害以及精神和身体创伤，来迫使受害者支付勒索金。一些组织甚至将网络犯罪作为通往现实暴力行为的“入门毒品”。今年夏天，欧洲刑警组织及其合作伙伴的调查人员标记了4340个“可怕的”网址并将其删除，作为对“The Com”（社区的缩写）持续打击行动的一部分。
这是一个松散的网络在线群体，其年轻成员参与了一系列非法活动，包括黑客攻击、虚假报警（swatting）、数字勒索、现实生活中的枪击事件以及其他身体暴力行为。
While digital intrusions having physical consequences is nothing new, cybercriminals in recent years have turned to real-life harm and mental and physical trauma to force victims into paying extortion demands. Some groups even use cybercrime as a gateway drug to real-life violence. Over the summer, Europol and its partners' investigators flagged 4,340 “horrific” URLs for removal as part of an ongoing crackdown on The Com (short for community), a loosely knit network of online groups whose young members participate in a range of illicit activities including hacking, swatting, digital extortion, real-life shootings, and other physical violence.
“我们已经看到‘暴力即服务’被使用，”比斯利说。他还调查过勒索软件攻击，攻击者直接向企业高管发送他们孩子学校的照片，试图施加心理压力以迫使对方支付勒索费。“我见过涉及受害者家人的威胁，这些威胁来自社交媒体侦察，在我们的领域，你越来越习以为常，这很不幸，”比斯利说。这种针对受害者公司员工的心理恐吓和伤害在过去几年中有所增加，以至于几乎变得司空见惯。
“We’ve seen violence as a service get used,” Beasley said. He’s also investigated ransomware attacks where C-suite executives receive pictures of their kids’ schools directly from the cybercriminals in an attempt to apply psychological pressure to pay the extortion fee. “I've seen threats involving people's families, from social media reconnaissance, and in our world you more and more come to expect it, which is unfortunate,” Beasley said. This type of psychological intimidation and harm against victim companies’ employees has seen an uptick in the last several years to the point where it's almost common.
根据Semperis的年度勒索软件风险报告，37%的勒索软件攻击涉及针对员工的心理或身体威胁。这项针对1200家在今年上半年遭受勒索软件攻击的机构进行的全球研究发现，攻击者利用心理恐吓（23%）和身体威胁（17%）来强迫支付赎金。他们不仅针对高管和员工，还针对受害者的家人。四分之一的受害者经历了“人肉搜索”（doxxing）——即在网上发布个人的详细信息，如姓名、家庭和工作地址以及电话号码——另有25%的受害者因勒索软件感染而不得不寻求心理和/或医疗治疗。
Thirty-seven percent of ransomware attacks involved psychological or physical threats against staff, according to Semperis’ annual ransomware risk report. The global study of 1,200 post-ransomware organizations conducted over the first half of the year found attackers threatening psychological intimidation (23 percent) and physical threats (17 percent), to force payment. They are not only targeting executives and staff, but also families of their victims. A quarter of these victims experienced doxxing – posting individuals' personal details, such as names, home and work addresses, and phone numbers online – while another 25 percent had to seek psychological and/or medical treatment in response to ransomware infections.
几乎相同比例（24%）的受害者聘请了个人安保团队，23%的受害者经历了虚假报警——即攻击者拨打紧急服务电话，报告虚假的事件（如炸弹威胁或活跃枪手威胁），以触发武装响应。此外，超过一半（53%）的受访者报告称，勒索软件攻击者在过去一年中确实实施了威胁。
Nearly the same number (24 percent) hired personal security teams, while 23 percent experienced swatting calls – that's when attackers phone emergency services and report a bogus incident like a bomb or active-shooter threat to trigger an armed response. Additionally, more than half (53 percent) of respondents reported that ransomware attackers carried through on threats in the past year.
受勒索机构员工报告的部分威胁包括：威胁性的短信、信件或包裹：57%；针对家人或朋友的威胁：37%；身体入侵：19%；绑架：17%；人身伤害：13%；跟踪：6%。
Some of these threats reported by ransomed organizations’ employees include: threatening texts, letters, or packages: 57 percent threats against family or friends: 37 percent physical intrusion: 19 percent abduction: 17 percent bodily harm: 13 percent stalking: 6 percent.
“是一些更知名的组织”在使用心理和身体威胁来强迫支付赎金，比斯利说。“我见过Scattered Spider，我见过ShinyHunters，我见过Lapsus$。”
“It's the more well-known groups,” using psychological and physical threats to force payments, Beasley said. “I've seen Scattered Spider, I've seen ShinyHunters, I've seen Lapsus$.”
值得一提的是，ShinyHunters在接受《The》独家采访时声称，他们“不攻击人类”。然而，他们确实承认，“在我们所做的工作中，有时我们不得不将企业逼到极限，才能让他们坐到谈判桌前。”
For what it's worth, ShinyHunters claimed in an exclusive interview with The that they “don't attack human beings.”They did, however, admit that “there are times in the work we do sometimes we have to push the corporate to the absolute limit to get them on the table.”
比斯利表示，这份报告给防御者和高管的启示是“坚持立场”。“不要在压力下屈服，要知道一切都会好起来的。如果你感到自己受到胁迫，那么一定要让执法部门介入。不要害怕报警。不要害怕让联邦调查局（FBI）介入，越早越好。而且不要付钱。”
The takeaway for defenders and executives from this report is to “stand your ground,” Beasley said. “Don’t buckle under the pressure, and just know that you know it's going to be okay. If you feel like you're under duress, then by all means get law enforcement involved. Don't be afraid to call the cops. Don't be afraid to get the FBI involved, sooner rather than later. And don’t pay them.”
最后这条建议很重要，因为一旦你付了钱，他们还会再来索要更多。Semperis的报告发现，69%的受访勒索软件受害者在过去12个月内多次成为目标，31%的受害者向攻击者进行了多次支付。“什么都不要付，”比斯利说。“永远不要付钱给他们。”
This last piece of advice is important, as once you pay, they're going to come back for more. Semperis’ report found that 69 percent of surveyed ransomware victims were targeted multiple times within the past 12 months, and 31 percent made multiple payments to attackers. “Don’t pay anything,” Beasley said. “Never pay them.”®