Secrets of a ransomware negotiator

Over time, gangs began licensing their model to freelancers, known in the industry as “affiliates”. When an affiliate buys the right to use a gang’s software and branding, they also gain access to its credibility. The gang in turn tries to enforce protocols so that its reputation is not undermined by the actions of freelancers. “It is strictly forb... See more

For the most part, the gangs operate like corporations, with human-resources departments and complex bureaucracies. Prominent groups issue press releases (“We are pleased to announce that we have successfully encrypted Henry Schein’s network and extracted 35 Terabytes of sensitive data”) and have user-friendly homepages on the dark web, where victi... See more

Many gangs still operate in Russia and Ukraine, though ransomware hubs have emerged in Iran, Brazil, India, North Korea, China and Peru. Some hackers seem to work independently, like pirates. Others appear to have links to their country’s government, or at least a licence to harass Western companies as long as they don’t cause so much harm that the... See more

Meghan Hannes, a cyber-insurance portfolio manager, remembers the moment she realised the ground had shifted, back in 2019. “My claims person called and said, ‘Hey Meg, we had seven ransomware demands this week, and they’re all for millions of dollars,’” she said