You choose the harder craft: not threat, negotiation. Modern Ransomware-as-a-Service operations treat extortion like a twisted form of customer support. You open the dark web support chat provided in the ransom note. You draft the message the way you once drafted a fake identity: patient, procedural, almost bureaucratic in its calm. > *"Welcome to support. We are not interested in destroying the firm. We are interested in being paid quickly and quietly. Cooperation shortens the clock. Delay does not change the price, it changes what else we release. We have provided proof of decryption on one of your minor files."* A negotiator replies from Blackridge's side within the hour, measured, careful, clearly an external incident response contractor reading from a crisis script. You trade numbers, deadlines, small manufactured concessions that cost you nothing and sound like mercy. At some point the conversation stops being about money and starts being about who blinks first in a language both sides have been trained to perform. It is a terrifyingly corporate transaction. - Let them believe the concessions are real and land the payment: [[Cybercrime/The_Phisherman/Blackridge Pays|Let them believe you'll be reasonable]] - Push one demand too far and watch the whole channel go cold: [[Blackridge Refuses|Push one demand too far]] <details> <summary>🔎 Behind the curtain: the ransom negotiation</summary> <p>This scene is close to how modern extortion really works. The big crews run <b>ransomware-as-a-service</b>: a core group rents out the malware and a polished "support" portal to affiliates, who split the proceeds. Negotiations happen in a chat on a hidden site, and the victim's side is usually a professional incident-response or ransom-negotiation firm, not a panicked executive, so both ends perform a strangely corporate script of deadlines and partial decryption "proofs". Two things the story leaves out: paying buys a promise, not certainty (keys sometimes fail, and stolen data can leak anyway), and in some countries paying can itself break the law. The US Treasury has warned that paying certain sanctioned ransomware groups can expose a company to penalties.</p> <p><b>Defender's lesson:</b> decide your ransom policy, and who may authorise a payment, before an incident, and involve law enforcement early. A negotiation under live pressure is the worst moment to improvise one.</p> </details>