The apparent abduction of “Today” co-host Savannah Guthrie’s mother is throwing a wrench into assumptions about the tools cybercriminals use, with one expert warning that “mastermind” hackers are swapping keyboards for guns and hired kidnappers.

In a dangerous trend of “wrench attacks,” they squeeze kidnapping victims or their relatives for cash, said Lisa J. Miller, a retired detective and law enforcement executive at the Colorado Attorney General’s Office.

The term originated in a 2009 web comic about a frustrated hacker who suggested using a $5 wrench to beat someone until they gave up their password, she said, since trying to crack it was too hard.

SEND US A TIP HERE

“In the beginning of this Nancy Guthrie case, we’re all taking a look at it, and we’re seeing things that just didn’t seem to fit,” Miller told Fox News Digital. “What we’re seeing with Nancy Guthrie is not a typical wrench attack.”

In traditional wrench attacks, sophisticated criminals behind computers identify potential targets, then recruit local muscle to carry out the violence, she said. The “masterminds” plan out the logistics — and pay thugs a cut to do the dirty work, which in some European cases has included torturing victims until they give up their passwords, accounts or other targeted information, she said.

NANCY GUTHRIE WAS ALIVE WHEN ABDUCTED, BLOOD EVIDENCE SHOWS ‘LAST STAND’ ON FRONT PORCH: RETIRED FBI AGENT

Pima County deputies examine a flyer taped to the mailbox outside Nancy Guthrie’s home in Tucson, Ariz., on Feb. 23, 2026. Guthrie, the 84-year-old mother of “Today” co-host Savannah Guthrie, is believed to have been abducted from her home in the early hours of Feb. 1. (Michael Ruiz/Fox News Digital)

In Guthrie’s case, Miller said it’s less likely that all of those tactics were employed because the person whose money they were likely seeking was her daughter, “Today” co-host Savannah Guthrie.

“The street level thug theory fits with what we’re seeing in the Guthrie case, because when the FBI released the pictures of this porch guy, and I’ve referred to him from the beginning as ‘porch monster,’ I mean, the guy comes across as a bit of a doofus,” Miller said. “Look at his getup, look at how he carries his firearm… yet there’s some very sophisticated elements to this case that again falls in line with what we see in a traditional wrench attack.”

MULTIPLE SUSPECTS ARE POSSIBLE IN NANCY GUTHRIE’S ABDUCTION

A well-wisher signs a banner with a photo of Nancy Guthrie and the words “Bring her home” outside the KVOA newsroom in Tucson, Ariz., on Feb. 12, 2026. Nancy Guthrie, the 84-year-old mother of journalist Savannah Guthrie, is missing from her Tucson home. (Rebecca Noble/Reuters)

For one, it’s been more than 100 days since purported ransom notes were sent to TMZ and local media, Miller noted, and no one has been arrested in connection with those.

The Pima County Sheriff’s Department, which is leading the investigation into Guthrie’s suspected kidnapping, did not immediately respond to a request for comment.

SIGN UP TO GET TRUE CRIME NEWSLETTER

An armed individual appears to tamper with a Google Nest camera at Nancy Guthrie’s front door in Tucson, Ariz., on Feb. 1, 2026, the morning of her disappearance. (FBI)

News outlets’ tip boxes are designed to help journalists get information from people like crime witnesses and whistleblowers without putting their identities at risk — which makes them useful tools for criminals, too, Miller said.

At least some of the early demands could have potentially been legitimate, Miller said. For one, Savannah Guthrie said as much in an interview with her “Today” colleague Hoda Kotb in March.

SAVANNAH GUTHRIE BELIEVES TWO RANSOM NOTES HER FAMILY RESPONDED TO WERE GENUINE

“I don’t think for a minute, and I’ve said before from the early stages, that the FBI would have put Savannah Guthrie [and] her family through the trauma of recording those videos if they did not believe that there was something real behind these videos,” Miller said.

At least one man, 42-year-old Derrick Callella of California, is accused of making a hoax ransom demand to capitalize on the crime without being involved in Guthrie’s disappearance. He sent the demand using less sophisticated attempts to cover his tracks and was identified and arrested within days.

LIKE WHAT YOU’RE READING? FIND MORE ON THE TRUE CRIME HUB

Derrick Callella allegedly tried to extort bitcoin from the Guthrie family after Nancy Guthrie’s disappearance. (Nathan Congleton/NBC/Getty Images, Obtained by Fox News)

The typical mastermind in a wrench attack is operating from overseas, likely in a country without an extradition treaty or where the government would be hostile to cooperating with the FBI, Miller said.

“They know where to go,” she told Fox News Digital. “They know how to hide their digital tracks, and they know where to operate from.”

FOLLOW THE FOX TRUE CRIME TEAM ON X

Aerial drone shots show the home and grounds of Nancy Guthrie in Tucson, Ariz., on Tuesday, Feb. 3, 2026. Nancy Guthrie, mother of ‘Today’ show host Savannah Guthrie, is suspected of being abducted from her home earlier this week. (Fox Flight Team)

In some cases where they’ve been arrested, masterminds have been linked to more than one abduction, she said. They’re typically young and computer savvy.

“Their working knowledge of computers and digital forensics is off the charts,” she said.

Nest doorbell camera video shows a masked man wearing gloves on her front steps around the time of her abduction, as well as three weeks earlier, creeping up to the home again. Her back door was also propped open by the time police arrived hours later, prompting questions about whether more than one person was involved.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

There is a combined reward of more than $1.2 million for cracking the case. The family is asking anyone with information to dial 1-800-CALL-FBI. Tipsters can remain anonymous by contacting the local Crime Stoppers affiliate, 88-Crime.

“Hopefully someone will see something, say something and allow the family to get Nancy Guthrie home,” Miller said.