Remix.run Logo
▲ gregsadetsky 11 hours ago

Can you shed a light on what this process looks like? Are negotiations are alike or completely unique? What does it boil down to..?

Thanks!

▲gregglain 11 hours ago | parent | next [-]

The book "Never split the difference" is a great read on hostage negotiations.

▲gregsadetsky 11 hours ago | parent [-]

I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.

▲gregglain 8 hours ago | parent [-]

ah. No idea.

▲throw5g6y53 5 hours ago | parent [-]

So the book "Never split the difference" might not be a great read on hostage negotiations?

▲BonerWiener 3 hours ago | parent [-]

You made an account just to verify this?

▲ckx an hour ago | parent [-]

Welcome to the Internet!

▲ofjcihen 10 hours ago | parent | prev [-]

No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.

For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.

Other actors though have a reputation to uphold to get paid and they know it.

An example of the process is something like:

1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.

2. Negotiators notified.

3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.

▲dmos62 an hour ago | parent | next [-]

What is COM?

▲wauce 7 hours ago | parent | prev [-]

do you capitalize tor too?