Even before the current administration, federal law enforcement's leaks of suspects, especially in high-profile crimes, have been highly unreliable and have ruined lives. See Wen Ho Lee, Richard Jewell, etc.
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.
Ridiculous that scumbags like this are tarnishing that space.
I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
“The statement said CyberSteward and Cypfer are separate companies with no officers, directors or employees in common, and that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner”
Jason Hogg, father of David Hogg survivor of the Parkland high school shooting, gun control activist, and former (‘25) DNC co-chair
> In late September, ShinyHunters hacked the FBI recruitment website fbijobs.gov
The OPM breach was 11 years ago and apparently the incompetence still reigns.
The quality of offensive tooling has somewhat improved during that period.
Breaking Bad vibes here. "You don't want a ransom negociator, you want a ransom negociator!"
Better than some random negotiator.
Even before the current administration, federal law enforcement's leaks of suspects, especially in high-profile crimes, have been highly unreliable and have ruined lives. See Wen Ho Lee, Richard Jewell, etc.
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.
Ridiculous that scumbags like this are tarnishing that space.
Can you shed a light on what this process looks like? Are negotiations are alike or completely unique? What does it boil down to..?
Thanks!
The book "Never split the difference" is a great read on hostage negotiations.
I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
Nothing is yet proven and other articles have painted this arrest as shocking.
based on history, expect more ridiculous scumbags in the future:
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...
“The statement said CyberSteward and Cypfer are separate companies with no officers, directors or employees in common, and that Cypfer was recently acquired by the Apros Group, a holding company led by Jason Hogg, a former FBI special agent and former CEO of Aon Cyber Solutions Group. In 2020, Aon aquired Cytelligence, a security consulting firm where Mr. Tobok was founder and CEO and Mr. Dubrovsky was a managing partner”
Jason Hogg, father of David Hogg survivor of the Parkland high school shooting, gun control activist, and former (‘25) DNC co-chair
How about that!
https://en.wikipedia.org/wiki/David_Hogg
That wikipedia page says David Hogg's father is Kevin Hogg.