Recording intelligenceAI-generated brief · check the source for context

Ransomware Negotiation Tactics

22:17 recording · EN · 2 speakers

Listen to the original

Listen to the episode

Brief overview

Ransomware negotiation has become a professional industry built on psychology, and paying ransoms keeps funding the attacks.

  1. Negotiation is psychology, not price hagglingNegotiators flatter the attacker's skill and challenge how the number was reached, because naming a figure too early means paying more.
  2. Paying ransoms funds better ransomwareLockBit was successful enough to reinvest the proceeds into newer versions - LockBit 1, 2, 3 - so every payment fuels the next attack.
  3. The middlemen cannot be assumed trustworthyA Digital Mint employee working as a negotiator was indicted in the U.S. for participating in ransomware attacks, and firms often recruit from the dark web.
Executive Summary AI
  • Globe financial and cybercrime reporter Alexandra Posatzky traces ransomware negotiator Curtis Minder back to his first tech job at CENCOM Internet, a dial-up provider in central Illinois, where he confronted his hastily fired boss for logging into the system from a router in a nearby town.0:16
  • Minder later founded GroupSense doing threat intelligence on the dark web, and in his first official ransomware negotiation during the COVID pandemic he talked a hacker down from $2 million U.S. to a figure in the low six digits, though the insurance company was eager to settle before he could push it to five figures.1:52
  • Posatzky lays out the scale of the problem: ransomware damages were expected to reach $57 billion U.S. worldwide in 2025, Net Diligence sees cyber insurance claims with payments as high as $75 million U.S. against demands as high as $150 million U.S., and LockBit, the group behind the Indigo and SickKids hacks, is alleged by U.S. officials to have made at least $100 million in ransom demands.2:10
  • She explains that negotiation is a game of human psychology - acknowledging the attacker's skill, crying poor on the company's behalf, and avoiding positional bargaining for as long as possible - while trust is a real problem, as a Digital Mint negotiator in Chicago was indicted in the U.S. for participating in ransomware attacks.11:16
  • Rather than an outright ban, experts she spoke to suggest phasing payments out: first mandatory reporting of every ransom paid, to whom and how much, then an oversight board that reviews each request, signalling to criminals that we are closed for business.19:02
Key Quote
“It's a $300 billion US industry.”
— Alexandra Posatzky9:43
Key Quote
“Apparently, according to Curtis Minder, who I spoke to for this piece, it's really just a game of human psychology.”
— Alexandra Posatzky11:16
Key Quote
“And so a lot of the time, people forget that these hackers on the other end of the transaction, these like shadowy bad guys, like they are actually human beings, they're people and they are, they have emotions.”
— Alexandra Posatzky11:23