Cybercriminals are working hard to elicit feelings of fear and a sense of urgency with the content they put on splash screens during a ransomware attack, a recent study found.

Commissioned by security firm SentinelOne and conducted by a psychologist from De Montfort University in the U.K., the study, “Exploring the Psychological Mechanisms used in Ransomware Splash Screens,” analyzed 76 ransomware screens. These screens are the pop-up messages threat actors typically use to alert a victim that the device has been locked and list their demands for payment.

Splash Screens and Social Engineering

Though the study suggested that most of the content malicious actors use is negative, there are occasions when they attempt to seem approachable, if only to get victims to pay up. They even used humor occasionally.

The Register made note of a few interesting findings, such as the fact that bitcoin was the preferred payment mechanism in three-quarters of the splash screens evaluated. About 51 percent used some kind of timeline or clock to make sure victims understood they had a limited window of opportunity to gain access to their devices again.

Surprisingly, the social engineering techniques are often coupled with elements of running a friendly and helpful business. The analysis found callouts to speak with a ransomware team member, answers to common inquiries and instructions for paying the ransom.

Scare Tactics Abound

On the other hand, threat actors are not afraid to use splash screens to convey how tough they are. Many use a Jigsaw motif from the horror movie “Saw,” or even steal legitimate symbols such as an FBI badge, SC Magazine reported.

Scarier than any imagery are details of what will happen if victims refuse to pay. These consequences include users having their files deleted or their confidential information released online.

The real question is what words, images or other elements work best for ransomware operators? Even if we answer those questions, we may not see the rate of ransomware decrease anytime soon. After all, once a machine is infected, the actors are already in control. No matter what pops up after that, victims have every reason to be afraid.