Buy time
Every hour of conversation is an hour the incident-response team spends containing the attack, restoring backups and scoping the breach.
~ / ransomware-negotiations $ cat case-notes.md
Ransomware negotiations
Talking to the people holding your data hostage.
I am a professional ransomware negotiator and have been involved in more than 40 ransomware negotiations as part of my role at SOCRadar. Here is what that work looks like, and the crisis-negotiation techniques behind it.
$ stat --summary ./negotiations
cases 40+
role negotiator · advisor
clients anonymised
book ● in progress
whoami --negotiator
What a negotiator actually does.
Read the adversary
Threat intelligence on the group (its history, affiliates, leak-site behaviour and whether it honours deals) shapes every reply.
Verify before trusting
Proof-of-life files, file-tree checks and decryptor tests come before any decision about payment.
Keep decisions with the victim
The organisation decides; the negotiator advises on options, legal and sanctions constraints, insurer requirements and communication.
Client names, amounts and identifying details are never shared.
./stairway --interactive
The FBI Behavioral Change Stairway Model.
Developed by the FBI’s Crisis Negotiation Unit, the model describes five steps a negotiator climbs in order. Select a step to see how it applies to a ransomware case.
Active listening
Let the other side talk. Paraphrase, summarise and use minimal encouragers ("I see", "go on") so they feel heard. In a ransomware case this is where you learn what the operator actually wants, how organised the group is, and where the pressure points are.
man negotiation-techniques
Techniques from FBI crisis negotiation.
You will often see these shared online as the “7 FBI rules of negotiation”. There is no official FBI list by that name. The techniques come from Chris Voss, the FBI’s former lead international kidnapping negotiator, and his book Never Split the Difference; the FBI’s own documented framework is the Stairway Model above.
01Tactical empathy
Deliberately recognising the other side’s perspective and emotions to gain influence, not sympathy.
02Mirroring
Repeating the last few words they said, as a question. It keeps them talking and reveals more than a direct question would.
03Labeling
Naming their emotion or position out loud: “It seems like time matters a lot to you.” Labels defuse tension and invite correction.
04Accusation audit
Listing the worst things they might think about you before they say them, so those objections lose their force.
05Calibrated questions
Open “how” and “what” questions (“How am I supposed to do that?”) that hand them the problem and create an illusion of control.
06Getting to “No” and “That’s right”
A “No” lets people feel safe and in control; a “That’s right” signals they feel genuinely understood. Both move the talk forward.
07The late-night FM DJ voice
A slow, calm, downward-inflected voice that signals control and lowers the emotional temperature, useful even in text, through pacing and tone.
RansomSim — Ransomware Negotiation Trainer
A realistic ransomware negotiation simulator for training, built on 256 real-world negotiation transcripts, more than 926 pages on negotiation tactics and 30 hours of training. Practise against a threat actor before it is real.
Open RansomSim ↗A book on ransomware negotiation
I am writing a book on ransomware negotiation, drawing on real (anonymised) cases. Title and release date will be announced here.
grep -r ransomware ./talks