Ransomware Negotiation Tactics Have Turned Into a Business Process
Help Net Security, Tuesday, September 8th, 2026
Intel 471's Dave Ross explains how ransomware groups profile victims, set demands and apply pressure during negotiations.
In this Help Net Security video, Dave Ross of Intel 471 describes what happens behind the scenes in ransomware negotiations. Groups research a victim's revenue and insurance coverage, use test decryptions to prove they hold a working key, and often set demands at roughly 1% to 5% of annual revenue, shifting deadlines based on the victim's response.
Some split work among researchers, negotiators and pressure teams, drawing on a criminal service economy for language skills, data review and legal analysis.
Ross also covers multi-extortion tactics like data theft, DDoS and contacting customers or journalists, and outlines how organizations should prepare.