They Can Hack But They Can’t Haggle

Some ransomware gangs are threatening to destroy the data they’ve encrypted if the victim company calls in professional negotiators to bargain for decryption tools. In a statement posted to its blog, Grief Corp (a ransom gang) said: “We wanna play a game. If we see a professional negotiator from Recovery Company™ – we will just destroy the data. Recovery Company™ as we mentioned earlier will get paid either way.” A rival gang, RagnarLocker, made similar threats. A threat analyst said the fact that gangs don’t want their victims to get help from negotiators or law enforcement means that is exactly what they should do, because it lowers the ransom and the criminals know it. Another negotiator observed that dealing with the gangs is like talking to “the help desk from hell.”