Navigating a ransomware attack is an incredibly stressful situation, and the decision to negotiate with the attackers is far from straightforward. Both paying and refusing to pay, come with significant advantages and disadvantages that require careful consideration. It is worth clarifying that ransomware negotiation is not paying a threat actor! The art of negotiating is, communicating with the threat actor once a demand has been made, and attempting to regain some control of the situation to help minimise the damage caused.

Pros of Negotiating:

• Data Recovery: The primary potential benefit is regaining access to your encrypted data. If successful, negotiation can avoid the time and cost associated with data restoration from backups, minimising operational disruption. All decrypted systems should be considered compromised, and may contain backdoors. It will however allow recovery of key operational data for a company, that can be added to clean installs of systems once checked.
• Insights into Attackers: Engaging with attackers might offer valuable insights into their tactics, techniques, and procedures, potentially aiding future defense efforts. Knowing how threat actors gained access can prevent future attacks.
• Reduced Ransom Demand: Properly conducted, organisations can significantly reduce the ransom demand.
• Time to Support Incident Response: When dealing with a ransomware incident, time is critical and even more so for the team involved with the incident response. Internal or external incident response teams need as much time as possible, to help restore systems from backups and investigate the incident thoroughly.
• Reduced Media Scrutiny: For organisations concerned about reputational damage, resolving the attack quietly through negotiation might seem preferable to public disclosure.
• Speed of resolving the incident: At Brainstorm Security we help companies resolve incidents quickly. We always ask companies to notify law enforcement of any breaches or demands made. However, the amount of cyber attacks taking place is increasing year on year. This means for most victims, law enforcement cannot always provide a 5 star investigation that includes help with negotiations.For organisations concerned about getting computer systems operating quickly, so the company can continue trading, negotiation can be a good option.
• Double extortion: Double extortion ransomware is a sophisticated cyberattack that combines traditional encryption-based ransomware with the threat of publicly leaking stolen data. This adds another layer of pressure on victims, making it a particularly dangerous and costly form of ransomware.

Here’s how it works:

Attackers gain access to your network: They may use various methods like phishing emails, malware downloads, or exploiting software vulnerabilities. Data exfiltration: They steal sensitive information like financial records, customer data, or internal documents. Encryption: They encrypt your files, rendering them inaccessible and demanding a ransom for decryption. Double threat: They threaten to both keep your files encrypted and publicly leak the stolen data if the ransom is not paid. This doubles the potential damage for victims:

Data loss: Businesses rely on their data for daily operations, and losing access can cripple their activities. Data breach: Leaked data can expose sensitive information, leading to financial losses, reputational damage, legal consequences, and potential identity theft for individuals whose data is exposed. This strategy aims to maximize pressure on victims, making them more likely to pay the ransom to avoid both data loss and public exposure.

Cons of Negotiating:

• Encourages Future Attacks: Paying a ransom might signal to attackers that your organization is willing to pay again, making you a more attractive target. This emboldens attackers and fuels the overall growth of the cybercrime economy.
• No Guarantee of Recovery: There’s no guarantee that paying the ransom will actually lead to data decryption, or unauthorised release of data. Attackers might disappear with the money, leaving you with unrecovered data and financial losses.
• Legal and Regulatory Issues: Depending on your location and industry, paying ransom might violate legal, sanctions or regulatory compliance requirements, leading to additional penalties.
• Technical Challenges: Even if decryption keys are provided, they might not function correctly, requiring further technical expertise and resources to recover data fully. Negotiating with highly technical adversaries, requires good operating procedures to protect the negotiator and victim from further technical threats.

Additional Considerations:

• Severity of Attack: The potential impact of data loss and downtime heavily influences the decision to negotiate. For critical data or operations, restoring access quickly might outweigh ethical concerns.
• Negotiation Expertise: Negotiating with cybercriminals requires specialised skills and experience. Engaging professional negotiators can improve your chances of success and minimize risks.
• Cybersecurity Insurance: Some insurance policies cover ransomware attacks and might assist with negotiation and financial recovery.

The decision to negotiate with ransomware attackers is complex and requires careful evaluation of all risks and potential outcomes. Consulting cybersecurity professionals and legal counsel can provide valuable guidance in navigating this challenging situation.

Further Resources:

• CISA: Ransomware Guide: https://www.cisa.gov/stopransomware: https://www.cisa.gov/stopransomware

Remember, prevention is always the best approach. Implementing robust cybersecurity measures and regularly backing up your data are crucial in minimising the risk and impact of ransomware attacks.