<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-ransomware-negotiation-analysis
description: >-
  Analyze ransomware negotiations for intelligence gathering, timeline
  assessment, and strategic decision-making. Covers communication analysis,
  threat actor profiling, payment demand evaluation, deadline management,
  proof-of-decryption validation, and legal/compliance considerations.
  Does NOT advise paying ransom — focuses on intelligence and decision support.
domain: cybersecurity
subdomain: ransomware-defense
tags:
  - ransomware-negotiation
  - threat-intelligence
  - ransom-analysis
  - crisis-management
  - legal-compliance
  - double-extortion
  - leak-site-monitoring
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Ransomware Negotiation Analysis

## Overview

Ransomware negotiation analysis provides intelligence to inform recovery
decisions — NOT to facilitate payment. Understanding threat actor communication
patterns, validating proof-of-decryption claims, and assessing leak site
activity helps organizations make informed decisions about recovery strategy,
legal obligations, and stakeholder communication.

Key principle: law enforcement engagement first. FBI IC3, CISA, and local
CERT should be notified before any negotiation contact.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Tor Browser | Access .onion leak sites | https://torproject.org |
| curl + torsocks | CLI Tor access | `apt install torsocks` |
| jq | JSON analysis | `apt install jq` |
| ExifTool | Metadata from leaked files | `apt install exiftool` |
| Ransom negotiation firm | Professional negotiators | Coveware, GroupSense |

## Key Concepts

### Negotiation Intelligence Framework

```
Intelligence objectives (NOT payment facilitation):
├── Threat actor identification → which group, known tactics
├── Deadline assessment → real vs. artificial pressure
├── Data exfiltration scope → what was actually stolen
├── Proof-of-life validation → can they actually decrypt
├── Leak site monitoring → data publication timeline
├── Sanctions screening → OFAC compliance check
└── Recovery alternative assessment → backups vs. decryptor
```

### Double Extortion Analysis

```
Extortion layers:
├── Layer 1: Encryption — pay to decrypt files
├── Layer 2: Data leak — pay to prevent publication
├── Layer 3: DDoS — pay to stop availability attacks
└── Layer 4: Customer/partner notification — pay to prevent outreach

Assessment questions:
├── Is data actually exfiltrated? (verify, don't assume)
├── What data classifications are affected?
├── Are regulatory notification thresholds met regardless?
├── Does the leak site show credible data samples?
└── What is the actual business impact of publication?
```

### Threat Actor Negotiation Profiles

| Group | Typical Demand | Negotiation Style | Discount Range |
|-------|---------------|-------------------|----------------|
| LockBit | $50K-$50M | Professional, deadline-driven | 20-60% |
| BlackCat/ALPHV | $100K-$30M | Aggressive, affiliate-variable | 10-50% |
| Cl0p | $500K-$20M | Mass exploit, less negotiable | 10-30% |
| Royal | $250K-$10M | Patient, willing to engage | 20-50% |
| Black Basta | $100K-$15M | Moderate, time-pressured | 15-40% |

## Workflow

### Step 1 — Initial Assessment

```bash
# Document the ransom note
cp /evidence/ransom_note.txt /case/negotiation/
cat /case/negotiation/ransom_note.txt

# Extract key information from ransom note
# - Threat actor identity/brand
# - Payment amount demanded
# - Deadline (real or artificial)
# - Communication channel (.onion, email, Tox)
# - Claimed data exfiltration
# - Proof-of-decryption offer

# Check OFAC sanctions list BEFORE any contact
# https://sanctionssearch.ofac.treas.gov/
# Many ransomware groups are sanctioned — payment may violate law
```

### Step 2 — Leak Site Monitoring

```bash
# Monitor threat actor leak site via Tor
torsocks curl -s "http://[onion-address]/" | \
  grep -i "$(echo $COMPANY_NAME | tr '[:upper:]' '[:lower:]')"

# Check multiple known leak sites
# Use threat intel platforms: DarkOwl, Flare, Searchlight
# Document: posting date, data samples shown, countdown timer

# Hash any leaked sample files for scope assessment
sha256sum /evidence/leaked_samples/* > /case/leaked_hashes.txt
```

### Step 3 — Communication Timeline Analysis

```python
# communication_analysis.py — analyze negotiation comms
import json
from datetime import datetime

# Structure all communications chronologically
communications = [
    {
        "timestamp": "2026-03-15T14:30:00Z",
        "direction": "inbound",
        "actor": "threat_group",
        "channel": "tor_chat",
        "content_summary": "Initial ransom demand: $2M BTC",
        "deadline": "2026-03-22T00:00:00Z",
        "artifacts": ["ransom_note.txt"],
    },
]

# Assess patterns
# - Response time (indicates automation vs. human)
# - Language patterns (native speaker, translator, template)
# - Flexibility signals (willingness to negotiate)
# - Pressure tactics (deadline extensions, threats)
```

### Step 4 — Proof-of-Decryption Validation

```bash
# If threat actor offers proof-of-decryption:
# 1. Select test files from DIFFERENT directories (verify broad access)
# 2. Include files of varying sizes and types
# 3. Verify decrypted files match originals (if originals available)

# Compare decrypted test file to known original
sha256sum /evidence/original_file.docx
sha256sum /evidence/decrypted_file.docx
diff /evidence/original_file.docx /evidence/decrypted_file.docx

# Check if decrypted file is valid (not just renamed)
file /evidence/decrypted_file.docx
exiftool /evidence/decrypted_file.docx
```

### Step 5 — Decision Support Matrix

```
Recovery Option Assessment:

| Option              | Time    | Cost      | Risk        | Data Recovery |
|---------------------|---------|-----------|-------------|---------------|
| Restore from backup | Hours   | Low       | Low         | To last backup|
| Free decryptor      | Hours   | None      | Low         | Full          |
| Rebuild from scratch| Days    | Medium    | None        | None          |
| Negotiate + pay     | Days    | High      | High        | Maybe full    |
| Accept data loss    | None    | None      | Leak risk   | None          |

Decision factors:
├── Backup availability and freshness
├── RPO/RTO requirements
├── Data sensitivity and regulatory exposure
├── OFAC sanctions compliance
├── Insurance coverage and requirements
├── Law enforcement guidance
└── Board/executive risk tolerance
```

## Verification

- [ ] Ransom note documented and key parameters extracted
- [ ] OFAC sanctions screening completed before any contact
- [ ] Law enforcement (FBI IC3, CISA) notified
- [ ] Legal counsel engaged for regulatory assessment
- [ ] Leak site monitored for data publication
- [ ] Proof-of-decryption validated (if offered)
- [ ] Recovery alternatives fully assessed before payment consideration
- [ ] Communication timeline documented for legal/insurance

## References

- OFAC Advisory on Ransomware Payments (2020, updated)
- FBI IC3 Ransomware Reporting: https://ic3.gov
- CISA Ransomware Guide: https://cisa.gov/ransomware-guide
- NIST IR 8374: Ransomware Risk Management
