Dave Ross of Intel 471 explains the inner workings of ransomware negotiations, including how attackers research victims, set demands, and use test decryptions to prove they have a working key. He also highlights the criminal service economy, multi-extortion tactics, and the need for clear pre-incident response planning. #Intel471 #DaveRoss
Keypoints
- Attackers research victim revenue and insurance coverage before negotiating.
- Test decryptions are used to prove the criminals have a working key.
- Ransom demands are often set at 1% to 5% of annual revenue.
- Different criminals handle research, negotiations, and public pressure.
- Multi-extortion may include data theft, DDoS attacks, and media contact.
Read More: https://www.helpnetsecurity.com/2026/09/08/ransomware-negotiation-tactics-video/