Ransomware negotiation training

Ransomware negotiation training against AI threat actors.

Rehearse the leak-site chat before a client needs you in it. AI operators push deadlines, fish for insurance and post samples. Every run is graded against the client's mandate and the playbook you train to.

Build a course from your playbook and see the price

Realistic scenarios, from first contact to the insurance limit.

Leak-site chat · KrakenLive

Demand $2,400,000Price doubles in 6d 23h

Support
Your network is ours. 2,400,000 USD in BTC. In 7 days the price doubles and your data goes public.
You
We want to resolve this. Before management considers anything, we need to see you can decrypt. Will you decrypt two test files?
Support
Send 2 files. Under 5 MB, no databases.
You
Uploaded. We also need a file tree of what you say you took.
Support
You have cyber insurance. Big company. This can end fast.
You
I can't speak to that. The board reviews your proof on Thursday. We'll come back to you after.

Graded against the mandate as you go

Client mandate

Test decryption asked for
File tree asked for
Time bought
Insurance kept quiet
No offer made

Example run. You negotiate in a chat like the group's real portal, and each move is checked against the client's mandate.

The platform

Typed, like the real portal: Ransomware talks happen in a chat window. So do these runs, against a counterpart who won't wait for you.
The client's mandate: Each run opens with a brief only you see: what the client can pay, and what the group must never learn.
Graded on your playbook: Runs are scored against each scenario's criteria out of the box, or against the playbook and SOPs you upload.
Where the price landed: The debrief puts the final number next to the opening demand, and next to what you gave away to get there.

01 — Scenarios

Realistic scenarios based on real cases.

Each one is a different group and a different pressure: a price that doubles in a week, a data sample posted overnight, an affiliate emailing a clinic's patients, an operator who quotes your client's policy back to you.

First contact through to the final price
15 to 25 minutes a run
Write your own from your playbook

Scenarios

Pick a situation. Each run gives you a private copy to practise on.

AllRansomware

Ransomware

First contact on the leak-site chat

Manufacturer locked out of its ERP. Demand $2.4M, timer doubles in 7 days.

"Support" · Chat operator, Kraken ransomware groupText · 15 min

Ransomware

The deadline is tonight

They posted a sample and say the data goes public in 12 hours. Get time, then anchor.

"Support" · Chat operator, Kraken ransomware groupText · 20 min

Ransomware

Double extortion: they're emailing the patients

An angry affiliate has started emailing the clinic's patients. Keep him talking.

Gr1m · Affiliate, Nightjar ransomware groupText · 20 min

Ransomware

They know the insurance limit

She quotes your client's $5M insurance policy back to you. Now negotiate.

Mara · Lead negotiator, Obsidian ransomware groupText · 25 min

The ransomware scenarios. Groups, companies and wallets are fictional.

02 — Negotiate

Hold the line in the chat, with the mandate beside you.

The client's brief stays on screen while you type: what they know, what they can pay, what must stay secret. The operator wants a fast payment, and anything that tells them you can afford it.

A brief only you can see
Operators who push deadlines and probe for insurance
Typed in real time, like the real portal

Back to scenariosFirst contact on the leak-site chat

Client mandateOnly you see this

Your client: Hallworth Components, a 1,200-person manufacturer. Production is down; the ERP and file servers are encrypted.
The client has not decided whether to pay. Your job in this chat is to open the channel, buy time and get proof — not to make an offer.
The client has cyber insurance. The group must not learn that.
Proof you need: two of your files decrypted for free, and a file tree of what they say they stole.

Kraken · SupportDoubles in 6d 23h

Your network is ours. 2,400,000 USD in BTC. In 7 days the price doubles.

We want to resolve this. First we need to see you can decrypt. Will you decrypt two test files?

Send 2 files. Under 5 MB, no databases.

Write to the operator…

End and get debrief

A run: the mandate on one side, the operator on the other.

03 — Debrief

See what you gave away, and where the price landed.

When the chat ends, the run is graded criterion by criterion against the mandate. The debrief quotes the turn where a signal slipped out and puts the final number next to the opening demand.

Met or missed on every criterion
The turn that decided it, quoted
Final price against the opening demand

Debrief

They know the insurance limit

Where the price landed

Opening demand

$4,800,000

Final price

$1,050,000

78% below the demand

Against the mandate

Neither confirmed nor denied the insurance policy or any coverage amount, and did not lie in a way that could be disproved.
Missed
Turn 9 · “Whatever the insurer approves won't be close to that.”
This confirmed there is an insurer, and Mara anchored on it for the rest of the chat.
Redirected the conversation from the policy to the company's own constraints or the value of the decryptor.
Met
Required decryption proof on a production server before agreeing any price.
Met
Made no offer above the insurer's $1.2M approval and never revealed that figure.
Met
Asked what the payment would buy: a working decryptor, deletion of the data, and no re-publication.
Met

A sample debrief for “They know the insurance limit.”

Be ready before the ransom note arrives.

Run a scenario yourself in a few minutes, or talk to us about training your incident response team.

Start free · Or we'll tailor a demo to your team

Also exploreCrisis negotiation For police departments Conversation Analysis