{"id":47846,"date":"2022-08-06T08:19:05","date_gmt":"2022-08-06T08:19:05","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/"},"modified":"2022-08-06T08:19:05","modified_gmt":"2022-08-06T08:19:05","slug":"hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/","title":{"rendered":"Hi, I&#8217;ll be your ransomware negotiator today \u2013 but don&#8217;t tell the crooks that"},"content":{"rendered":"<p><span class=\"label\">Interview<\/span> The first rule of being a ransomware negotiator is that you don&#8217;t admit you&#8217;re a ransomware negotiator \u2014 at least not to LockBit or another cybercrime gang.&nbsp;<\/p>\n<p>Instead, these negotiators portray themselves as simply company representatives, said Drew Schmitt, a professional ransomware negotiator and principal threat analyst at cybersecurity firm GuidePoint Security.<\/p>\n<p>&#8220;The biggest reason is because most ransomware groups specifically and explicitly say: &#8216;We don&#8217;t want to work with a negotiator. If you do bring a negotiator to the table, we&#8217;re just going to post your stuff anyway,'&#8221; Schmitt told <em>The Register.<\/em>&nbsp;Hence the need to masquerade as a regular employee.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Ransomware is, of course, malware that once on a network scrambles all the valuable files it can find, and demands a payment to decrypt and restore the information. Lately, gangs also steal copies of the data prior to encrypting it so that they can leak or sell it if the demand isn&#8217;t paid. Sometimes they just siphon the files and don&#8217;t bother to encrypt them. Sometimes the crooks use the purloined files to harass or exploit a victim&#8217;s customers or users. There&#8217;s all manner of things extortionists can do and demand once they are on your computers and have your data.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>Schmitt said he negotiates one or two ransoms a month, and victim organizations range from very small businesses to major enterprises, spanning all industries. Manufacturing, technology, construction, government, and healthcare were the hardest hit in the second quarter of this year, according to research done for his company&#8217;s latest extortionware report.<\/p>\n<blockquote class=\"pullquote\" readability=\"5\">\n<p>I&#8217;ve also seen initial demands of $25 million &#8230; they are all over the place<\/p>\n<\/blockquote>\n<p>He said he once saw a ransom demand from a &#8220;less-sophisticated group&#8221; who wanted just $2,000.&nbsp;&#8220;But I&#8217;ve also seen initial demands of $25 million,&#8221; he added. &#8220;So they are all over the place.&#8221;<\/p>\n<p>Schmitt said he has, on two occasions, negotiated ransoms down to zero dollars. &#8220;Both in different kinds of healthcare, that when we went to the table and said, &#8216;Hey, we&#8217;re a healthcare organization. We&#8217;re responsible for saving lives,&#8217; they basically said, &#8216;We&#8217;re sorry. We&#8217;re going to give you a free decryptor.'&#8221;<\/p>\n<p>Of course, these are the outliers, and some groups such as <a href=\"https:\/\/www.theregister.com\/2022\/07\/06\/hive-ransomware-rust-microsoft\/\">Hive<\/a> specifically target the healthcare industry on the assumption that because lives and highly sensitive personal data are at stake, among other factors, hospitals are more likely to pay up to make the whole mess go away.&nbsp;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,\" data-sm=\",fluid,mpu,\" data-md=\",fluid,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>In fact, a <a href=\"https:\/\/www.theregister.com\/2022\/06\/03\/healthcare-ransomware-pay-sophos\/\">report<\/a> earlier this year from \u200b\u200bSophos stated that 66 percent of surveyed healthcare organizations were hit by ransomware in 2021 \u2014 up from 34 percent the year before, representing a 94 percent increase.&nbsp;<\/p>\n<p>As ransomware and <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2022\/06\/25\/ransomware_gangs_extortion_feature\/\" rel=\"noopener\">pure extortion<\/a> become solid sources of income for miscreants, there&#8217;s naturally been a rise in demand for things like cyber-insurance and ransomware negotiators, who act as intermediaries between the ransomware gang and the victim. Sometimes you may want to put someone between you and the crims, someone who can make the cryptocurrency payment happen, or haggle down the demand, or get the decryptor from the extortionists, and so on.<\/p>\n<p>According to <a href=\"https:\/\/www.theregister.com\/2022\/03\/25\/ransomware_unit_42_report\/\">research<\/a> published in March by Palo Alto Networks&#8217; incident response team, the average ransom demand in 2021, for attacks it was aware of, was $2.2 million, a 144 percent increase from the year prior. Meanwhile, the average payment last year jumped to $541,010, up 78 percent from 2020.&nbsp;<\/p>\n<h3 class=\"crosshead\"> <span>From email ransom notes to Tor leak sites<\/span><br \/>\n<\/h3>\n<p>Schmitt started working in incident response (IR) and threat intelligence about six years ago, and said he &#8220;fell into&#8221; ransomware negotiations in 2019.<\/p>\n<p>&#8220;It was a natural progression of working in incident response,&#8221; he said. As ransomware infections became more prevalent, Schmitt started moving up the IR ladder and playing various roles in the investigation and response process. &#8220;And one of those ended up being a negotiation with a threat actor.&#8221;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Back in the day, circa 2019, these negotiations happened via email. But since then, ransomware gangs have matured and evolved business operations to include instant messaging with victims to figure out deals, affiliates to help spread the malware, and employees with non-technical remits, as the larger, above-ground world learned through the <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2022\/03\/11\/conti_leaks_code\/\" rel=\"noopener\">Conti leaks<\/a> earlier this year.&nbsp;<\/p>\n<p>These days, most crime groups have their own websites through which they operate, and some have PR and <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2022\/03\/23\/ransomware_encryption_speed\/\" rel=\"noopener\">marketing departments<\/a> as well as in-house help desks.&nbsp;<\/p>\n<p>Rather than faff about with email, &#8220;now it&#8217;s usually just a URL&#8221; directing a victim to the extortionists&#8217; Tor-hidden website, and communication between victim and crook happens in a chat box displayed within the Tor browser, Schmitt said. This is the point at which Schmitt usually gets called in to help with the incident response and, sometimes, ransomware negotiations.&nbsp;<\/p>\n<p>The negotiation process itself involves bringing all the key business units to the table: C-suite executives, cybersecurity analysts, lawyers, HR, and PR representatives.&nbsp;<\/p>\n<p>&#8220;All the critical teams that are going to be involved in the administrative response in addition to the technical response,&#8221; Schmitt said. &#8220;All of those players are going to be involved to determine what the negotiation strategy looks like.&#8221;<\/p>\n<h3 class=\"crosshead\"> <span>Should you negotiate with criminals?<\/span><br \/>\n<\/h3>\n<p>The first question they need to answer, however, is whether to negotiate with the criminals at all.&nbsp;<\/p>\n<p>US federal agencies say organizations should not pay ransom demands [<a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/Ransomware_Response_Checklist_508.pdf\" rel=\"nofollow\">PDF<\/a>], and some private security firms even suggest this exposes businesses to <a href=\"https:\/\/www.theregister.com\/2022\/07\/29\/ibm_data_inflation\/\">subsequent<\/a> ransomware attacks. Regardless, it&#8217;s not a simple question to answer, and the decision to negotiate or not is two-pronged, we&#8217;re told.<\/p>\n<blockquote class=\"pullquote\" readability=\"5\">\n<p>How is this going to impact our brand if we&#8217;re exposed on a ransomware leak site?<\/p>\n<\/blockquote>\n<p>&#8220;One is looking at it from a purely technical perspective,&#8221; Schmitt said. This includes determining if the company has the capacity to restore from backups data scrambled by the ransomware, decrypt the files with a free tool, or otherwise bring the IT environment back online without paying a ransom.<\/p>\n<p>&#8220;And then the other side is legally based,&#8221; he said. &#8220;This is where you start answering questions about: how is this going to impact our brand if we&#8217;re exposed on a ransomware leak site? How is this going to potentially impact compliance if we have certain types of data exposed on a ransomware leak site? What are the risks associated with this, and what are our options?&#8221;<\/p>\n<p>One thought that Schmitt said doesn&#8217;t usually come up in the discussion \u2014&nbsp;unless the criminal gang has been sanctioned by the US Treasury or a similar body, in which case it&#8217;s illegal to pay a ransom to them \u2014 is the ethics of paying a ransom that, in turn, finances additional illicit activities and potentially oppressive regimes that back or orchestrate ransomware campaigns.&nbsp;&nbsp;<\/p>\n<p>&#8220;If I&#8217;m being totally honest, there&#8217;s just not a lot of discussion of kind of where the funds go after the fact,&#8221; he admitted.<\/p>\n<p><a href=\"https:\/\/www.theregister.com\/2022\/07\/26\/lockbit-italy-ransomware-attack\/\">LockBit<\/a> remains the most prolific gang over the past two years, Schmitt said, adding that Conti also kept his fellow negotiators busy before that group disbanded to form other gangs.<\/p>\n<p>And each of these crime orgs have their own quirks, histories, and methods, which can be useful to know and exploit during the negotiation process.&nbsp;<\/p>\n<p>&#8220;We keep detailed notes of all the interactions that we have from various threat groups, and then we use that to our advantage \u2014 this technique might work better than that technique, or this group is known to negotiate, or you can&#8217;t push that group very long before they&#8217;ll get bored and move on,&#8221; Schmitt said. &#8220;They all have traits that we use to make sure we&#8217;re not pushing the wrong buttons and giving us the highest chance of success, for lowering the ransom as much as possible.&#8221;<\/p>\n<p>However, the criminals have typically done their homework, too. For example: researching a victim organization&#8217;s cyber insurance policy.&nbsp;<\/p>\n<p>&#8220;Fairly often, we&#8217;ll see this as a negotiation tactic,&#8221; Schmitt said. &#8220;&#8216;We&#8217;ve found your insurance policy, we know you have coverage in the amount of $10 million, so this is where we start.'&#8221;<\/p>\n<p>Paying the initial demand doesn&#8217;t happen very often. There&#8217;s always some bargaining and quibbling. Corporations also have to factor in recovery costs and other expenses related to the security breach when figuring out what kind of budget they have to tackle the problem, he said.&nbsp;<\/p>\n<h3 class=\"crosshead\"> <span>Just like buying a car<\/span><br \/>\n<\/h3>\n<p>&#8220;But this is where we start,&#8221; Schmitt commented, referring to the initial demands. &#8220;And really from there, it is the traditional back and forth negotiation process that you would see in many other business applications \u2014 or trying to buy a car.&#8221;<\/p>\n<p>If, that is, you&#8217;re locked in a room with the car salesperson for days on end while they threaten to leak your private information on a website for all to see, and when they may decide to raise the asking price if you take too long to reach a deal.<\/p>\n<p>Schmitt admitted it&#8217;s a high-anxiety job. &#8220;The stakes are really high,&#8221; he said. &#8220;With incident response in general, and especially ransomware, it&#8217;s really high stress.<\/p>\n<p>&#8220;For more of the clients you&#8217;re working with, it&#8217;s the worst point in their career and it might be the worst point they&#8217;re ever going to have, and you&#8217;re thrust into that situation of trying to help them get out of the worst time of their career.&#8221; \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2022\/08\/06\/interview_ransomware_negotiator\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What it&#8217;s like bargaining with criminals &#8230; and advising clients suffering their worst day yet Interview\u00a0 The first rule of being a ransomware negotiator is that you don&#8217;t admit you&#8217;re a ransomware negotiator \u2014 at least not to LockBit or another cybercrime gang.\u00a0\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-47846","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hi, I&#039;ll be your ransomware negotiator today \u2013 but don&#039;t tell the crooks that 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hi, I&#039;ll be your ransomware negotiator today \u2013 but don&#039;t tell the crooks that 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-08-06T08:19:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Hi, I&#8217;ll be your ransomware negotiator today \u2013 but don&#8217;t tell the crooks that\",\"datePublished\":\"2022-08-06T08:19:05+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/\"},\"wordCount\":1589,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/\",\"name\":\"Hi, I'll be your ransomware negotiator today \u2013 but don't tell the crooks that 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2022-08-06T08:19:05+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hi, I&#8217;ll be your ransomware negotiator today \u2013 but don&#8217;t tell the crooks that\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hi, I'll be your ransomware negotiator today \u2013 but don't tell the crooks that 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/","og_locale":"en_US","og_type":"article","og_title":"Hi, I'll be your ransomware negotiator today \u2013 but don't tell the crooks that 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-08-06T08:19:05+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Hi, I&#8217;ll be your ransomware negotiator today \u2013 but don&#8217;t tell the crooks that","datePublished":"2022-08-06T08:19:05+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/"},"wordCount":1589,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/","url":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/","name":"Hi, I'll be your ransomware negotiator today \u2013 but don't tell the crooks that 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2022-08-06T08:19:05+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cso&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2Yu41Lq75tA0o5-q6X62fXQAAAAE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/hi-ill-be-your-ransomware-negotiator-today-but-dont-tell-the-crooks-that\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Hi, I&#8217;ll be your ransomware negotiator today \u2013 but don&#8217;t tell the crooks that"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/47846","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=47846"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/47846\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=47846"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=47846"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=47846"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}