How does one negotiate with ransomware attackers?

Abstract

Ransomware attacks are a serious and growing threat based on a cybercrime business model exploiting the lack of security in many organizations. The criminal groups behind these attacks have received tens of millions of dollars in ransomware payments, as more and more organizations choose to pay to minimize disruption and the risk of further financial loss. Despite the importance of the topic, the process of ransom negotiation has remained underexplored in the literature. For this reason, the aim of this article is to provide an overview of the negotiation process and to give an insight into the inner workings of these procedures. Specifically, we will look at what happens from the time of the occurrence of a ransomware attack until the time of the decision to pay the ransom. This is followed by an analysis of the steps leading up to and during the negotiation process. Finally, a brief overview of the Conti ransomware negotiation process is provided.