Ransomware Negotiation Tactics Evolve into Business Process

• •Ransom demands are set at 1% to 5% of annual revenue.
• •Ransomware negotiations now involve specialized roles and tactics.
• •Preparation and stakeholder involvement are critical before a ransomware incident.

In a recent video, Dave Ross from Intel 471 discusses the evolving tactics of ransomware negotiations. He explains that attackers conduct thorough research on victims' financials and insurance to set ransom demands typically between 1% to 5% of annual revenue. The negotiation process has become systematic, with roles divided among researchers, negotiators, and public pressure teams. Multi-extortion strategies are also employed, including data theft and DDoS attacks. Preparation before an incident is crucial, involving clear communication protocols and stakeholder engagement. This shift indicates a growing sophistication in ransomware operations, impacting organizations across various sectors.