The moment a ransomware incident hits, the atmosphere on the ground changes unmistakably.
Servers that were running normally stop responding, and business systems go down one after another.
The phones keep ringing, and chat fills up with messages mixing anxiety and confusion.
In the middle of all this, what appears on someone's screen is a link on Tor and a cold, mechanical countdown.
That screen, which visually drives home that "things will get worse when time runs out," puts on psychological pressure even beyond the technical problem.
Over my career as a white-hat hacker, it has not been unusual to get a call at exactly this stage.
In most cases, it starts with words like "Are we already out of options?" or "We don't know what to prioritize."
Both the staff on the ground and the executives are waiting for someone to calmly make sense of the situation.
When the word "negotiation" comes up at this point, it is natural that some people feel resistant, as if it means admitting defeat.
In fact, when I first took on this work, I felt the same way.
But after experiencing many incidents, my thinking changed.
Negotiation is not an act of giving in.
It is a means of taking back control of time, information and decision-making that is slipping away amid the chaos.
Without being swept up by emotion and without playing to the other side's pace, you take back, one by one, "what we can actually control right now."
From my experience in the field, that is why negotiation exists as a step in the process.
Ransomware Is Not "Malware" but a "Human Adversary"
There is one thing I want to make clear first.
It may seem a little surprising, but it is a very important premise in practice.
Ransomware response is no longer only about dealing with software or malware.
On the other side of the screen, there is always a "person."
Judging by how they operate, modern ransomware groups look almost like a single organization, or even a company.
- They have dedicated operators who handle only negotiations
- They provide dedicated negotiation portals on the dark web
- Exchanges proceed in a way similar to ticket management
- Reply deadlines and escalation rules are clearly defined
Once you actually engage with them, it quickly becomes clear that this is not "opportunistic crime."
They have procedures, divide up roles and act based on past successes.
And they are not only looking at technical information.
What they observe most carefully is our reactions.
How fast we reply.
Changes in our wording.
Whether our explanations are getting longer.
Whether vague expressions are creeping in.
Impatience, anxiety, confusion.
They pick up, with surprising accuracy, the moment those emotions surface.
They understand well that human wavering, even more than technical weaknesses, becomes leverage in negotiation.
That is why, in ransomware response,
before getting into the technical side, I always make sure everyone shares the premise that "the adversary is a person."
The First Reply Is the Most Dangerous Moment
In ransomware response, what I am most careful about is actually not advanced analysis or recovery work, but the very first words.
Right after an incident, nobody can stay calm.
I have seen many times how internal staff, trying somehow to break the deadlock, reply to the attacker out of good intentions or fear.
But that single reply can unintentionally contain important information:
- Whether backups exist
- How much of the business has been stopped
- Signs of concern about regulatory compliance or reporting to supervisory authorities
- A sense that things are in turmoil internally
Even if the writer is unaware of it, these things come through between the lines.
Attackers pick up these fragments of information while probing for "where there might be room to push."
That is why the first words cannot be taken lightly.
Looking back, I have seen many cases where the course of events was decided right there.
So we consolidate external communications into a single channel as early as possible.
No emotion, and no more information than necessary.
We switch to calm, businesslike, procedure-driven exchanges.
At that point, the counterpart the attacker sees changes from a confused organization to someone experienced in handling this.
Curiously, that alone changes the atmosphere in quite a few cases.
A single choice of words can make the other side's approach calmer, or open up room to buy time.
Treat the Dark Web Negotiation Portal as "Evidence"
In many cases, negotiations take place through a dedicated portal on Tor.
From the outside, it may look like an ordinary chat screen.
But we do not think of it as a place for conversation.
Rather, we treat it as a place where evidence accumulates, to be used later to make sense of the situation.
So we follow consistent rules for how we communicate there:
- Record every message in chronological order
- Never take the other side's claims at face value; always verify them
- Send replies only after clarifying our intent, not based on the flow of the moment
- No small talk and no emotional exchanges
It may be closer to "managing" than "talking."
At the same time, outside the portal, we research information on the dark web and past cases.
How far has this group gone before?
Does it tend to keep its promises?
Does it have a track record of actually publishing data?
Whether or not we understand this background makes a big difference in how we respond.
Some groups relentlessly bluff, while others operate according to a fairly fixed pattern. If you respond without knowing the difference, you may give up more than necessary or, conversely, provoke them.
That is why I feel that carrying out intelligence gathering to understand the adversary in parallel with the negotiation itself
ultimately leads to fewer misjudgments.
A deep look into the strange world of the dark web
The Essence of Negotiation Is "Time," Not "Money"
It is often misunderstood, but the goal of negotiation is not necessarily "deciding on the amount."
From what I experience on the ground, the biggest theme is how to secure time.
Ransomware response is not completed through negotiation alone.
If you can buy time, you can push forward with many tasks behind the scenes at the same time:
- Confirm how far recovery from backups is possible
- Isolate affected systems and prepare to rebuild them
- Identify credentials (passwords and keys) that may have been compromised, and reset all of them
- Check whether lateral movement has occurred, and contain it
- Organize the information legal, PR and executives need to make decisions
If even one of these tasks is missed, it will have consequences later.
That is why you need time to move forward as calmly as possible.
In the negotiation, we deliberately slow the pace of the exchange by layering confirmations and technical questions one at a time.
We do not give answers right away; we move forward while making sense of the situation.
For the attacker, stalling is undesirable.
For the defender, on the other hand, that time provides the breathing room to widen options and avoid bad decisions.
I feel that buying time through negotiation ultimately forms the foundation that supports the quality of recovery and decision-making.
If They Say "We Can Decrypt It," Always Verify
Once negotiations begin, in almost every case you will be told something like "we can decrypt everything without any problem."
But we never proceed on the basis of that claim.
We always ask for sample decryption.
And not under just one condition:
- Choose several different file formats
- Include data spanning multiple systems
- Rather than leaving it to them, specify files that we choose ourselves
Testing decryption under these conditions reveals whether the tool really works and whether the data returns to its original state.
When we actually check, it is not unusual to find that only some files can be decrypted, that decryption fails on large data, or that files are corrupted after decryption.
Even if it looks on the surface as though "decryption worked," whether the data is usable for business is a separate question.
If you make decisions while skipping this check, you may later realize that you have almost no options left.
That is why, even if it takes time, the step of confirming as a fact whether decryption is possible is indispensable.
I see this work during negotiation as important groundwork for making decisions based on reality, not emotion.
"We Stole Your Data" Claims Often Waver Under Scrutiny
In so-called double extortion cases, using the threat of publication on a dark web leak site, attackers will very likely claim that "they have exfiltrated data."
Even when such claims are made, we do not react emotionally.
First, we look at whether there is anything that can be confirmed as fact.
As part of that, we check whether they can provide samples.
For any data presented, we work through points such as:
- When the data is from
- How sensitive it is
- How much actual impact it has on the business
- Whether it overlaps with data we already hold in backups
When we actually check, there are quite a few cases where the data turns out to be old, not particularly valuable to the business, or simply greatly exaggerated in volume or content.
By verifying the claim as a fact once, the anxiety you felt at first becomes less likely to drive your decisions directly.
It is not so much that the fear disappears; it is closer to say that it is replaced by information you can calmly work through.
That is why I consider this step an indispensable verification task within the negotiation.
Control Information Without Lying
We do not lie during a response.
We do not provoke the other side or try to rattle them emotionally.
And of course, we never cross the law or any line that must not be crossed.
On the other hand, we manage what we deliberately do not say very consciously:
- How far recovery work has progressed
- How much urgency there is internally
- At what stage executives intend to make a decision
- How we are thinking about legal and regulatory matters
As a rule, we do not disclose this kind of information in the negotiation.
Attackers try to read the situation from our reactions themselves.
The interval before a reply, the choice of words, slight changes in tone.
From these elements, they infer what is going on inside.
That is why silence, pauses and a consistent writing style have meaning.
When the situation is harder to see, it becomes harder for the other side to rush their decisions.
As a result, there is room for us not to be pushed too far into a corner.
I feel that choosing not to disclose information is itself one technique for moving a negotiation forward.
Paying Does Not Reduce the Leak Risk to Zero
This is something I always tell people, at every incident.
Even if the ransom is paid, you will not be in a position to say with certainty that the data will not get out.
I think that is a point where it is better not to expect too much.
Negotiation is not a way to solve everything.
What it can do is reduce risk, nothing more.
Even so, there is value in moving the negotiation forward.
While the exchange continues, you can prepare in parallel for things like:
- Getting organized in case public disclosure or explanations become necessary
- Understanding how far the impact extends
- Aligning with legal and regulatory requirements
- Securing time to keep recovery work moving without stopping
Whether you are able to do these things makes a big difference in how well you recover afterward.
Whichever choice you make, if you can make decisions while keeping a clear picture of the situation, recovery is often relatively fast and confusion is kept down.
That is my impression from what I have seen in the field.
Negotiation does not guarantee an outcome, but it is an act that leaves room to recover.
I want to make that point clearly, without any misunderstanding.
What leaked credentials on the dark web really look like, and why corporate information is targeted
Why Ransomware Response Should Never Be a One-Person Job
Having been involved in many responses, I have found that the points where I think "this is going to come back to bite us later" tend to have something in common:
- Over-explaining the situation
- Letting impatience show in messages and actions
- Conveying urgency directly to the other side
- Acting in ways that contradict the response policy agreed internally
Each of these seems like natural behavior in the moment.
That is because people want to resolve things quickly and somehow bring the situation under control.
But looking back, there are quite a few cases where each one of these handed the other side material for their decisions.
Ransomware negotiation is not completed through technical response alone.
It always has to move in step with the overall incident response, legal judgments and executive decision-making.
It is not something to be driven by one person's judgment, nor something that can be considered in isolation from everything else.
Negotiation needs to be properly built into the overall response plan as one step in the process.
I believe that is a precondition for not making the situation worse.
As Someone Who Works on the Front Line, One Last Thing
Ransomware negotiation is not an act of handing something over.
I see it as a response for gradually taking back control in an unavoidable situation.
If you can proceed calmly, it leads to:
- Securing the time needed for decisions
- Separating the other side's claims into what is fact and what is not
- Limiting the spread of damage
- Shortening the path to recovery
- Keeping the front line and executives in a state where they can decide calmly
In a ransomware incident, more than technical superiority, which side controls the flow of the conversation affects the outcome.
Now, while nothing is happening, you can take a moment, just once, to think through "if it does happen, who will step forward, and how will we decide?"
That alone should change, at least a little, how you act when the moment comes.
https://cyber.spool.co.jp/whats-mitre-pre-attck-and-how-to-use-it-in-threat-intelligence/
Stay Secure with CyberCrew
CyberCrew's dark web monitoring responds to these threats in real time, helping stop unauthorized access attempts before they escalate into full-scale breaches.
