When should you negotiate with ransomware attackers?

1. Statistical data indicates that negotiation leads to a 50% decrease in Ransom (Cambridge Ransomware Research and others) 2. Negotiation can potentially also lead to lesser primary and secondary losses, as this buys time that could lead to decryption (if they are not double extorting) 2. Companies should always strive to avoid payment, if possible (from an ethical perspective) 3. There can be lots of scenarios where a Ransomware attack could cause a company to close or impact human lives as well (production, agriculture and critical infrastructure. In these scenarios sometimes you need to negotiate and pay a Ransom.

Negotiation is not paying a threat actor, that decision comes later, after negotiation has taken place. I would recommend professional negotiation every time. The victim can not only reduce the demand, but identify intelligence, such as what data has been exfiltrated, how they may have gained access and crucially obtain time, to help incident response teams recover systems. A ransomware negotiator can help remove the emotion that is understandably felt, by the company or individual victim during an incident. This can help keep the negotiations professional and help you achieve your end goals. Never use a 'Cyber Security' team who cold call you during an incident. They are probably connected to the threat actor.

A lot of professional have said DON'T NEGOTIATE... but i think its important to first understand what data is relevant and whats not, then to negotiate with them to be able to retrieve the important data. it doesn't mean you have to pay them straight away. in this instance its also good to hire a professional to do it so that you do not make emotional decisions

First, threat intelligence based on our observations do not indicate a bias towards more or less ransomware attacks if the ransom is paid, for a variety of reasons. The biases that payment equates to future attack seem to center around the visibility available to actuaries, than a pattern in attackers' behaviors. Second, platitudes about further incentivizing attacks by paying criminals are just that - platitudes. The bulk of decision makers' personal economics are tied to the financial success of their business or employer. Most small businesses leverage personal credit, or back business credit off personal credit. Large companies have more insulation, but large losses strongly affect variable pay and even employment.

The hackers expect you to negotiate them down from the original amount. They set the demand like a car dealer sets his initial price. And the longer you can keep them waiting and still keep a dialogue with them, the more likely they are to come down from the number. Usually the original demand can be negotiated down to 10 to 40 percent. The key question is how deep the attacker was able to penetrate the network. The larger groups often negotiate with 30 or 40 victims at once. For them, this is a mass deal. They are easier to convince to accept an offer. On the other hand, a single attacker who only has one victim at a time will try to squeeze as much as possible out of them. This makes negotiations much more difficult.

You may already feel very experienced in negotiation, however with ransomware negotiations it is worthwhile considering the use of a professional ransomware negotiator. You need to remember you are dealing with criminals, who are happy to break the law and double cross victims. Threat actors may also be seeking more intelligence from you, without you knowing, that could be used against you.

Negotiations with cyber criminals should be treated objectively like any other business transaction - emotions are of no use here. Many victims who enter into negotiations without external support fail at this point. Cyber criminals who rely on ransomware are often willing to negotiate. There are certainly cases in which the ransom demand could be reduced to a smaller percentage of the originally demanded amount. This is because not only the companies affected by the attack, but also the blackmailers are under immense time pressure! The longer a negotiation drags on, the more time the victims have to reset their systems. Statistics show that between 25 and 30 percent of all ransoms are paid - and cyber criminals know this too, of course.

It is important not to lie to the attackers. The materials in the ransom notes typically contain victim-identifying information. Sometimes the attackers already have complete inventories of what they've stolen, and what they've encrypted. Imagine negotiating for a used car, but the car salesman has your complete credit history, paycheck, current bank balance, and what you just told your spouse you are willing to spend in front of them. Then, they let you tell them how you have no money, when they know exactly how much money you have. That is a fairly accurate of a typical ransomware negotiation.

i would recommend engaging a professional negotiator, because that person is not emotionally tied to the data so they will be able to not only buy time for your IT team to fix things but also to better understand exactly what data has been stolen and to ensure that no additional data is taken.

Complete data recovery is extremely difficult. Attackers know to attack cloud data, and backups, right at time of attack. In modern attacks, they've learned to attack just enough of the data they think you need, to quickly a pay a not-too-painful ransom, so that they can come back against in a year or two. In many modern attacks, endpoint security devices are the largest form of data corruption due to their attempts to stop the attacker through killing malware halfway through encrypting that file (only for the malware to start back up, much like zombie horror films).

This is simple business for a ransomware actor, and will do anything they can to achieve maximum ROI Fundamentally that means doing what they can to force a payment: - encrypt data - destroy backups - steal data - set time limits But often those that pay, whilst there get *some* means of recovering their files, may face a decryption tool that is far from “enterprise-grade”. I’ve seen victims: - have their decryption tool quarantined by AV - corrupt the very files they’re trying to recover - only work on a single file at a time (and on an enterprise level file server, that can take a LONG time)

RPA is becoming extremely easy to access and, simulates a human behavior (trained as a human). Dennis Underwood is correct. These are the same technologies that enable individuals to snag the latest sneakers, video game systems, or luxury handbags to sell for a large profit. And the individuals learning in those (semi harmless) constructs are improving their skills for other information swipes. If you're systems are valuable, they need protection.

I believe the AI tool that wrote this paragraph is speaking about "defense in depth". Security tools are defeated, degraded, and bypassed during attacks. Attackers use Robotic Process Automation (RPA) to allow junior criminals to have "scripts" which automate many steps in the attack. This means the accuracy of the RPA made by the attacker determines a lot of the speed and success of the attack. Automated defenses are absolutely key. It is absolutely a John Henry-esque situation, where security analysts are manually trying to catalog enough victim behavior to make a defensive response, and - even when aided by automation - are far too slow to stop attacks.

Attackers typically leave a way in that is undetectable to most or all security tools. They also will not communicate every way they gained access to your network. Quite honestly, given that they probably purchased the access, they may not even know how initial access was gained. They of course do know the extra backdoors they left for re-entry and monitoring of the victim's financial situation. This is a great time to employ defense in depth tactics, and secure technologies that enable you to find and root out the remaining attackers. It is vitally crucial to focus on the opportunity you have been given to secure for the next attack, versus a sense of hubris.

The key thing is that whether you chose to pay a ransom, or recover your data via backups, that doesn’t really resolve the incident. In far too many cases, the attackers access to the network, either via compromised credentials or some form of remote access tool, is left intact, with the focus being getting the data and business back up and running again. Ransomware doesn’t just appear like Pokémon, work out how it got there and close that hole.

If the blackmail not only relates to the encryption of the data, but also threatens to publish it on the Internet, dealing with a cyber attack is much more complex. This is because it is impossible to find out whether the stolen data was really destroyed after the ransom was paid. In recent years, numerous companies have been blackmailed several times with the same data - which was ultimately published on the Internet despite multiple ransom payments. Monitoring underground marketplaces or the dark web must therefore become part of a company's IT security as a preventative measure in order to always be one step ahead of cyber attacks.