Say less: Reframing the risks of ransomware negotiation

Ransomware poses a significant threat to society by disrupting essential services, compromising sensitive data, and imposing substantial economic costs. Ransomware attacks on organizations often lead to a negotiation over payment for decryption keys. Previous work has analyzed this negotiation in terms of finding the mutually agreeable value of the encrypted data. This work reframes and extends this narrow analysis to consider the information security risks of conducting a negotiation in multiple extortion situations, and analyses the data created and stored within the negotiation itself. Based on a set of ransomware negotiations (n=318), we quantify and model the information risk of entering into a ransomware negotiation, and contrast it with the potential benefits gained. This modeling shows that negotiations are necessary to enable payment, and that they typically reduce the ransom by more than 60 %. In addition, entering negotiations enables the victims to use various gambits to reduce cost or extract information for free. Conversely, entering negotiations also create a nearly 50% risk of creating additional channels for information leaks, as detected by forensic artifacts within the conversations. Victims of ransomware attacks and their advisors should conduct a risk assessment which fully assesses information security consequences before engaging in negotiation with ransomware groups, and should adapt their negotiation strategy to avoid third-party data leakage.