Ransomware Negotiation and Decision Framework

What This Framework Covers

• This is not a general ransomware response playbook — see the ransomware response playbook for technical containment, eradication, and recovery
• This framework covers the decision layer that sits above technical response: who decides whether to pay, how to negotiate if payment is authorized, and what regulatory obligations apply either way
• The decision framework applies to organizations that have experienced ransomware with data encryption, data exfiltration (double extortion), or both (triple extortion with DDoS threat)
• MITRE ATT&CK maps ransomware impacts to T1486 (Data Encrypted for Impact)

The Core Decision Tree

Is critical data encrypted and unrecoverable from backup?
├── YES → CAN YOU RESTORE FROM BACKUP?
│   ├── YES → Restore from backup. Do not pay.
│   └── NO → Decision: is the data critical to operations/survival?
│       ├── YES → Consider negotiation path
│       └── NO → Rebuild from scratch. Do not pay.
└── NO → Was data exfiltrated before encryption?
    ├── YES → Decision: is the data sensitive enough to cause
    │   regulatory/business harm if published?
    │   ├── YES → Consider negotiation path
    │   └── NO → Do not pay. Manage public disclosure.
    └── NO → (Encryption only) Restore from backup. Do not pay.

Decision Factors — When to Consider Paying

The Negotiation Lifecycle

If the decision is made to negotiate, follow this structured process. Negotiation with ransomware groups is high-stakes and should involve professionals where possible.

Phase 1: Preparation (Before Contact)

• Identify the ransomware group — use threat intelligence tools, ransom note analysis, file extension patterns, and TTP matching to determine which group is responsible
• Research the group — collect their negotiation history, typical payment amounts, decryptor reliability, and past behavior when demands are not met
• Set a budget — determine the maximum amount the organization is willing to pay (this is your walk-away number)
• Establish legal and insurance contacts — confirm your cyber insurance policy covers ransom payments, and confirm legal counsel is comfortable with payment under applicable laws (OFAC sanctions, UK Bribery Act, EU sanctions)
• Assemble the negotiation team — designate a single negotiator, a technical advisor, and a legal observer. Do not change negotiators mid-stream.

Ransomware group lookup:

Phase 2: Initial Contact

• Use the communication channel specified in the ransom note — do not use alternative channels
• Establish a negotiation identity — use a generic email or Tox ID. Do not use personal/professional identifiable accounts
• Send initial communication — acknowledge receipt of the demand. Do not accept or reject yet
• Request proof of decryption — ask the attacker to decrypt a single test file to prove they have a working decryptor. This is a standard request and most groups comply quickly
• Request proof of data deletion — ask for proof that exfiltrated data has been deleted. Most groups cannot provide reliable proof, but the request establishes your position

Sample initial message:

We have received your demand. Before we can discuss payment, we need:
1. Decryption of [test_file_hash] as proof of decryption capability
2. Confirmation of which data was exfiltrated (file listing or sample)
3. Proof that exfiltrated data can be deleted upon payment
We will review your response with our decision team.

Phase 3: Verification

• Verify the decryptor — decrypt the test file. If it succeeds, verify the decrypted content matches the original
• Document exfiltrated files — if the attacker provides a file listing, cross-reference against known sensitive data
• Assess decryptor reliability — test decryptor on a small set of non-critical files. Full encryption can take days for large systems
• Update the decision — based on what you learned in verification, confirm or update the original decision to negotiate

Phase 4: Negotiation

Negotiation timeline expectations:

Day 1: Initial demand received
Day 1-2: Preparation and initial contact
Day 2-3: Verification (test decryptor, exfiltrated file listing)
Day 3-7: Negotiation (2-4 rounds of counter-offers)
Day 7-14: Payment or walk-away decision

Phase 5: Payment Decision

• Final decision — confirm with legal, insurance, and executive team
• If paying: use cryptocurrency per the attacker’s instructions. Use a reputable OTC desk or cryptocurrency broker familiar with ransom payments. Retain all transaction records for insurance claims and legal documentation
• If not paying: proceed with Phase 6 (Recovery Without Payment)
• Document the payment decision — who was involved, what factors were considered, what the decision was. This is critical for post-incident legal and regulatory review

Phase 6: Recovery Without Payment

If the decision is not to pay, recovery relies on backup restoration, system rebuilding, or alternative decryption:

Legal and Regulatory Considerations

Key Principle — Decouple Legal from Technical Response

Legal counsel must be involved in the decision to pay, but they should not slow down the technical containment and recovery process. Establish communication channels between legal and IR teams at the beginning of the incident.

Post-Incident Review

Related

• Ransomware — detection and response for T1486 techniques
• Ransomware Fundamentals — covers the ransomware fundamentals concepts
• Ransomware Response — detection and response for T1486 techniques
• Data Exfiltration Detection — detection and response for T1048, T1052 techniques
• Zero Day & CVE Response — detection and response for T1588.006 techniques

Sources

• CISA — Ransomware Guide
• FBI — Ransomware Payment Guidance
• OFAC — Sanctions Guidance for Ransomware Payments
• Coveware — Ransomware Negotiation Best Practices
• MITRE ATT&CK T1486 — Data Encrypted for Impact