In this Help Net Security video, Dave Ross, Senior Director of the Intelligence Fusion Team at Intel 471, explains what happens behind the scenes during ransomware negotiations.
Ross walks through the tactics groups use once an attack begins, from research on a victim’s revenue and insurance coverage to test decryptions that prove they hold a working key.
He describes how demands are often set at roughly 1% to 5% of annual revenue, why deadlines move depending on how a victim responds, and how some groups split work between researchers, negotiators, and staff who apply public pressure.
He also covers the criminal service economy supplying language skills, data review, and legal analysis, along with multi-extortion methods such as data theft, DDoS attacks, and contact with customers and journalists. He outlines the preparation that should happen before an incident, including who is authorized to speak and which stakeholders to involve.
Download: 2026 Credential Risk Report