How Ransomware Groups Research Victims and Negotiate Demands

Summary

Intel 471’s Dave Ross explains how ransomware groups research victims, set demands, use test decryptions, divide negotiation roles, and apply multi-extortion tactics, alongside the value of pre-incident planning.

Key points

• Ross says attackers may research a victim’s revenue and insurance coverage before negotiations.
• Test decryptions can be used to demonstrate that attackers have a working decryption key.
• Ransom demands are often set at roughly 1% to 5% of annual revenue, according to the video.
• Some groups divide research, negotiation, and public-pressure work among different people.
• Multi-extortion tactics may involve data theft, DDoS attacks, and contacting customers or journalists.
• Pre-incident planning includes deciding who can speak and which stakeholders to involve.

People

Vendors