The vast majority of the competent people got DOGE’d. CISA lost like 40% of their staff including much of their red team specialty. 18F was completely eliminated (“Deleted” as Musk put it).
Even before the current administration, federal law enforcement's leaks of suspects, especially in high-profile crimes, have been highly unreliable and have ruined lives. See Wen Ho Lee, Richard Jewell, etc.
Working in the IR space I’ve had a lot of opportunities to work with negotiators before. Most of them are extremely professional and worth their weight in gold for what they provide to their clients.
Ridiculous that scumbags like this are tarnishing that space.
I do (half) remember reading that book! I actually meant to ask (in my question above) whether that book is actually "accurate"/representative of malware negotiations.
No honestly, most of the time it’s very formulaic. You can usually tell how it’s going to go once you know who has your data.
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
Ransom negotiators are all scumbags. Their actions perpetuate further criminality and place others at greater risk. Paying a ransom should always be a criminal offense, even if not paying means that people die and businesses are destroyed.
The OPM breach was 11 years ago and apparently the incompetence still reigns.
Ridiculous that scumbags like this are tarnishing that space.
Thanks!
For instance, what’s mentioned in the article about not dealing with COM actors is great advice because chances are they’re going to keep your data and sell it or use it for future extortions no matter whether you pay.
Other actors though have a reputation to uphold to get paid and they know it.
An example of the process is something like:
1. Notification by ransom operators Including proof. Negotiations start at some arbitrary number like 6 percent of reported earnings.
2. Negotiators notified.
3. Back and forth begins. “This isn’t really that much data, do you have more? It’s not that damning. Fine, my client is willing to pay 50k. 60k? Okay, but you need to provide proof of how you got I the data so we can close the gap”.
https://www.bleepingcomputer.com/news/security/ransomware-re...
https://complexdiscovery.com/a-48-month-federal-benchmark-re...