The Negotiation: 72 Hours Inside a Ransomware Deal

Описание: A ransom note. A 72 hour clock. A polite voice calling itself "support." This is how a ransomware negotiation actually unfolds, from the first login to the final offer.

This film is a dramatized composite. The company, people and chat messages are fictional. Every statistic is real and sourced below.

CHAPTERS
0:00 The note
0:31 Hour 0: How they got in
1:33 Hour 1: The war room
2:12 Hour 6: First contact
3:09 Hour 20: The dance
3:51 Hour 40: The second blade
4:32 Hour 60: The promise
5:19 Hour 72: Zero
5:51 The lesson

SOURCES
1. Sophos, The State of Ransomware 2026 (survey of 2,158 IT and security leaders across 17 countries, published June 2026): identity-based attack starts, phishing and email root causes, MFA findings, demands by revenue, payment vs demand, encryption and theft rates, backup recovery, recovery costs, team impact.
https://www.sophos.com/en-us/content/...
2. Coveware by Veeam, Q2 2026 ransomware report (July 2026): lateral movement and exfiltration in 76% of cases, record low payment rate, 15% payment rate for data theft only extortion, the finding that a gang taken down in 2024 kept data it promised to delete.
https://www.veeam.com/blog/cyber-exto...
3. Chainalysis ransomware findings for 2025 (about $820 million paid, second annual decline, record low payment rate, average network access price about $439 in early 2026), as reported by BleepingComputer, February 2026.
https://www.bleepingcomputer.com/news...
4. FBI Internet Crime Complaint Center, public service announcement on high impact ransomware, October 2019: the FBI does not advocate paying, some victims who paid never received keys, and victims are urged to report. Summary via WaterISAC.
https://www.waterisac.org/fbi-high-im...
5. U.S. Department of the Treasury, OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, September 21, 2021.
https://ofac.treasury.gov/media/91298...
6. CERT-In Directions under Section 70B(6) of the IT Act, April 28, 2022 (six hour incident reporting).
https://www.cert-in.org.in/PDF/CERT-I...
7. Trend Micro Research, What to Expect in a Ransomware Negotiation (2021): chat "support" portals, free sample decryption as proof, file lists, prices justified with the victim's bank balance or insurance.
https://www.trendmicro.com/en_us/rese...
8. Group-IB, Ransomware Negotiation knowledge hub: negotiation used to buy time for forensics and backup checks, test decryption, deletion promises not reliable.
https://www.group-ib.com/resources/kn...
9. ransomware.live public archive of leaked negotiation chats (example of a gang threatening a 20% price rise every 48 hours).
https://www.ransomware.live

Figures come from different surveys and datasets with different methods, so numbers vary between sources. Where a figure is a median or average, it is stated as such.

Visuals: original CGI and motion graphics. No stock footage. All sound effects synthesized for this film.

3D figures: Universal Animation Library by Quaternius (CC0).

#ransomware #cybersecurity #incidentresponse #TheHackPulse