cyber.hendryadrian.com
Interesting Stuff · darkowl.com

Ransomware Negotiation Tactics and Lessons From Three Real-World Cases

· Original article ↗

Summary

The article outlines steps for organizations considering ransomware negotiations, including assembling response specialists, investigating potential data theft, managing communications, and documenting exchanges. It cautions that payment offers no guarantee of recovery.

Key points

  • The FBI advises against paying ransoms, citing no guarantee of recovery and the risk of funding further criminal activity.
  • Before contacting attackers, organizations are advised to assemble security, legal, and leadership teams and investigate encryption and possible data exfiltration.
  • The article recommends monitoring leak sites and extortion channels, including for references to subsidiaries, brands, and executives.
  • Negotiation guidance includes centralizing and documenting communications, buying time for response work, and asking attackers to demonstrate that a decryption key works.
  • Instructure said it reached an agreement with ShinyHunters after the group claimed to have stolen records; the company said the data was returned and proof of destruction provided.
  • CWT reportedly negotiated a $10 million ransom demand down to $4.5 million and paid; UCSF paid more than $1 million for a decryption key and assurances about stolen data.
  • The article emphasizes preparation, secure backups, tested incident response plans, and experienced professional support; it warns that payment cannot ensure data will be deleted or systems restored.

Article Details

Topic
Ransomware negotiation tactics and real-life examples

Threat Actors

Ragnar LockerRansomware group that infiltrated CWT's network, exfiltrated data, and demanded a ransom.RansomHubNamed as an example of a ransomware group whose tactics may inform incident response.ShinyHuntersThreat actor group that allegedly breached Instructure and negotiated over stolen data.

Malware

NetWalkerThe attack was carried out by operators of the NetWalker ransomware, a notorious malware strain responsible for numerous high-profile extortion campaigns.

Products

Canvaseducation technology company Instructure, a cloud-based education technology company best known for its Canvas learning management system, which schools and universities use to manage coursework, assignments,

Countries

United States

Industries

Educationthreat actor group, ShinyHunters, revealed on their data leak site that they had allegedly breached the education technology company Instructure, a cloud-based education technology company best known for its CanvasHealthcareTravel managementtravel management company, CWT’s network, shutting down more than 30,000 computers and exfiltrating sensitive corporate data.

Related Articles