Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.

Ridiculous that scumbags like this are tarnishing that space.

▲

gregsadetsky 11 hours ago | parent | next [-]

Can you shed a light on what this process looks like? Are negotiations are alike or completely unique? What does it boil down to..?

Thanks!

▲

gregglain 11 hours ago | parent | next [-]

The book "Never split the difference" is a great read on hostage negotiations.

▲

gregsadetsky 11 hours ago | parent [-]

I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.

▲

gregglain 8 hours ago | parent [-]

ah. No idea.

▲

throw5g6y53 5 hours ago | parent [-]

So the book "Never split the difference" might not be a great read on hostage negotiations?

▲

BonerWiener 3 hours ago | parent [-]

You made an account just to verify this?

	▲	ckx an hour ago \| parent [-]
		Welcome to the Internet!

▲

ofjcihen 10 hours ago | parent | prev [-]

No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.

For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.

Other actors though have a reputation to uphold to get paid and they know it.

An example of the process is something like:

1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.

2. Negotiators notified.

3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.

	▲	dmos62 an hour ago \| parent \| next [-]
		What is COM?
	▲	wauce 7 hours ago \| parent \| prev [-]
		do you capitalize tor too?

▲

cobbzilla 10 hours ago | parent | prev | next [-]

based on history, expect more ridiculous scumbags in the future:

https://www.bleepingcomputer.com/news/security/ransomware-re...

https://complexdiscovery.com/a-48-month-federal-benchmark-re...

▲

nradov 10 hours ago | parent | prev | next [-]

Ransom negotiators are all scumbags. Their actions perpetuate further criminality and place others at greater risk. Paying a ransom should always be a criminal offense, even if not paying means that people die and businesses are destroyed.

▲

ofjcihen 8 hours ago | parent | next [-]

“Well then it’s a good thing I wasn’t paying a ransom but instead a pentesting fee!”

▲

lifeisloving 9 hours ago | parent | prev [-]

Huh? You'd rather criminals make a little less money than hospitals getting taken offline and people dying? Or power utilities. Very cringe to care more about how much pieces of paper a criminal has than your community member's lives. I definately do not want you as my neighbor.

▲

solyin 9 hours ago | parent | next [-]

Reading their comment strongly, as the guidelines suggest, it seems they want criminals to make $0 so they stop doing that. Is it not equally "cringe" to say society can't put up with some discomfort so assholes don't get free vacations and nice toys. It's a disguised trolley problem, and there's no agreed upon answer for that one either.

https://neal.fun/absurd-trolley-problems/

We all gotta do what we can to get through the day, but you can't live next to someone who has the same challenge but a different answer to some trolly problem? Is your future world just a bunch of closed communities where outsiders and ideas and their differ skin color and economic background aren't welcome?

▲

fc417fc802 5 hours ago | parent | next [-]

> it seems they want criminals to make $0 so they stop doing that

And yet arguably the criminals are unwittingly performing a useful public service we might describe as involuntary pentesting with a financial penalty on failure. The ethical way to get rid of the criminals in this scenario is to institute competent regulation (ie not mindless box ticking) and enforcement.

Hypothetically we are all arguably better off with a ransomware attack if the alternative is a cyberattack by a geopolitical adversary at a later date.

▲

pingou 2 hours ago | parent [-]

How is that a useful service? This is only useful because the criminals exist and are doing it. Are killers providing a useful service because people then use protection so they don't get killed?

Or perhaps it is useful by hardening systems in case you enter a war with another country, but presumably the other country has the same problems so it's a zero sum game.

	▲	rurban 2 hours ago \| parent [-]
		Killers must be a useful service, because the FBI, CIA and Department of War are all relying in their services. "By any means" is a current movie with the FBI case.

▲

lifeisloving 8 hours ago | parent | prev [-]

Yeah but you're proposing a trolley problem where we kill the five people on the other track so the single guy on the track can't have nice clothes lol.

Or we pay the criminals, not let innocent people die because turbo nerds care about rewarding cyber criminals who will exist no matter what.

So I guess we should just let people die though, atleast the feds will have jobs and be able to go on vacation and not those damn criminals!! Although I fail to see much difference between US law enforcement and cyber criminals, both of their existence relies on the threat of violance and the extortion of the public with that violence.

Also I'm pretty sure the FBI gave birth to the shiny hunters if you look into it for more than 10 minutes. Its a bunch of kids they basically have chosen not to punish at various points in their criminal evolution. Its almost like they need these phenomenons to exist.

My ideal society is one without crooked cops, but alas I dont think that's likely either so in the meantime, until we can find a solution to that problem we probably shouldnt punish the innocent patients of hospitals.

It seems to me that money and the status of criminals is more important to you than human life, so we should probably deal with whatever brain worm has infected you too.

▲

solyin 7 hours ago | parent [-]

So you should knows that there is no convincing evidence that brain worms cause specific cultural beliefs, religions, or ideologies, but in any case:

> When disagreeing, reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."

https://news.ycombinator.com/newsguidelines.html

Linked at the bottom of the page.

It's a stupid what-if scenario and there are endless variations. What if the ransomware attack doesn't kill anybody? What if the ransomware attack ends up saving a patient because the surgeon is given more time to think about a case so they don't make the mistake they would have? What if that hospital being shut down means a patient was sent to a different ER where the attending on duty was able to save the victim because of something unique to them from their past.

What if the cybercriminals doesn't use the money to buy nicer clothes but instead uses it to go on vacation but gets themselves killed? Are we supposed to be sad someone who inflicted pain on others died? Is all life sacred or not? Or is some more sacred than others? What if they use it to fund terrorists that end up killing lots of people, possibly even someone you know? Was it still worth it then? What if the criminals use to bomb churches and subways? What if one of the cyber criminals uses it to buy people? or kill homeless people for fun?

Another direction we can go is, I forget where this is from off the top of my head, but a human life is calculated to be worth about $10 million. So then if we're going to do another different point of view and put this into economics, we should figure out how many people shutting down the hospital will kill and see how much the group is charging and compare the two, right?

Talk is cheap and it's easy to spend other people's money or dismiss it as bits of paper. How much of your money are willing to give the criminals for the hospital to stay open? How many nights are you willing to go hungry and stay in so that the criminals can walk free? Because if it's arbitrary money that's not yours, of course it's easy to give away. It's based on a facile understanding of the world though.

If nothing is more important than saving human lives, what are you doing on HN, not curing cancer right now? People are dying!

	▲	jubilee33 4 hours ago \| parent \| next [-]
		Not touching on the rest of this back and forth but your probably wrong about parasites not affecting beliefs and critical thinking For instance toxoplasmosis https://asm.org/articles/2026/may/toxoplasma-made-me-do-it-h...
	▲	5 hours ago \| parent \| prev \| next [-]
		[deleted]
	▲	lifeisloving 5 hours ago \| parent \| prev [-]
		No offense, Im just going to end this conversation because you dont really seem capable of thinking deeply about a topic like this. I really wish I didnt have to share a world with people like you that think the value of a human life can be reduced to numbers on a calculator.

▲

nradov 8 hours ago | parent | prev | next [-]

Yes, I would absolutely rather have that. Preventing criminals from receiving additional money prevents them from having the resources to attack others in the future. Unlike you, I actually care about my community and think deeply about the consequences.

▲

maxbond 8 hours ago | parent | next [-]

Alternately they may not believe starving out the criminals will actually work and so foresee different consequences. Like when Google penalized SEO, and so spammers used their networks for extortion instead of spam. Similarly if we killed ransomware, the machinery built to conduct these attacks would not just lie fallow. It's capital that will continue to be leveraged to generate returns. We may not like the next business model they come up with.

It's not a contest, we all can care and think deeply and still come to different conclusions.

▲

matkoniecz 2 hours ago | parent [-]

I am not claiming there is magic "fix it" button, but yes, killing ransomware would be a good thing.

Deliberately letting ransomware go on, because you are scared that evil people may do something worse is quite absurd.

Deliberate welfare for criminals is in fact bad.

	▲	maxbond an hour ago \| parent [-]
		This is a very narrow framing, and that is what I am trying to get at. Obviously it would be absurd to deliberately provide welfare to criminal enterprises. But our adversaries get a vote in what happens. There is a level of risk at which you are forced to pay the ransom. If we don't get trapped in this false binary we might consider other options. I think the takeaway from my comment should be, if you want to make it illegal to pay a ransom to these groups, then you will also need to dismantle their infrastructure and organization. Otherwise you're just putting the ball in their court and hoping they'll fumble it. It's not that we're "scared," it's that that isn't a strategy.

▲

throw5g6y53 5 hours ago | parent | prev [-]

Even if it was a loved one of yours who was in danger? You would rather your children, parents, or spouse die, instead of paying the kidnappers a ransom?

▲

allenrb 8 hours ago | parent | prev [-]

It sounds like you don’t understand the problem very well. Forgive me if that’s an incorrect interpretation.

One way to prevent this type of crime is to ensure that it is never profitable. The downside is that there will be losses until the message is thoroughly communicated.

▲

lifeisloving 8 hours ago | parent [-]

And a new method is invented in about 24 hrs.

Who cares if criminals have nice things, Id rather innocent people dont die. Most criminals tend to find ways to ruin their own lives at some point anyways. Peoples lives > pieces of paper.

Its like you're proposing a trolly problem where you choose the 5 people on a track to die because you don't want the single guy on a track to have nice clothes.

	▲	maxbond 6 hours ago \| parent \| next [-]
		"Criminals having vacations and nice things" wasn't a great framing, "criminal enterprises continue to have revenue to reinvest in more crimes" is the better one.
	▲	matkoniecz 2 hours ago \| parent \| prev [-]
		> Id rather innocent people dont die that is one of reasons why ransomware should be being eliminated

▲

lifeisloving 9 hours ago | parent | prev | next [-]

Very cringe of you to automatically believe what the FBI tells you, especially when they're embarassed and trying to save face.

	▲	cindyllm 7 hours ago \| parent [-]
		[dead]

▲

ahelwer 11 hours ago | parent | prev | next [-]

Nothing is yet proven and other articles have painted this arrest as shocking.

▲

squidmaster an hour ago | parent | prev [-]

[dead]