Popularity: The New Forex within the Ransomware Panorama

Being seen as dependable is sweet for ‘enterprise’ and ransomware teams care about ‘model status’ simply as a lot as their victims

11 Dec 2025
 • 
,
4 min. learn

Black Hat Europe 2025 opened with a presentation by Max Smeets of Digital Rotes titled ‘Contained in the Ransomware Machine’. The discuss centered on the LockBit ransomware-as-a-service (RaaS) gang and Max’s analysis into their practices and operations. At their peak, between 2022-2024, the group had 194 associates, of which 110 had managed to get a cyberattack to the purpose of negotiation, with 80 of the associates succeeding in getting paid by the ransomware group. (As a reminder, the enterprise mannequin of ransomware is layered: ‘affiliate’ refers back to the staff that researches the sufferer’s networks and identifies and exfiltrates the delicate knowledge to a ransomware gang, resembling LockBit.)

Popularity is every part

A key message delivered by Max was relating to status, each of the sufferer and the ransomware group. The sufferer firm must uphold their status with their prospects and any trace of an information breach can considerably injury it. Curiously, the analysis confirmed that media protection is bigger for the businesses that pay as opposed to those who don’t pay the extortion demand and face longer disruption. The presenter’s view is that the information story turns into in regards to the fee and probably offers the indication the sufferer firm has misplaced management and wanted to pay, producing mistrust and injury to their model.

As somebody who has been near the topic for a number of years, I disagree with this view, a minimum of in some instances. From a purely monetary perspective, paying the demand may very well be the cheaper resolution, and there are a lot of examples the place the ultimate prices of a cyber-incident for those who don’t pay are a number of occasions larger than those who do pay – simply suppose again to the assaults on Caesers Palace and MGM. Firms have a accountability to shareholders and in some instances the best and quickest methodology to recuperate the enterprise and grow to be absolutely operational could also be to pay the ransomware extortion demand.

In the meantime, restoration of techniques could be advanced, new {hardware} must be acquired, and backups should be restored and analyzed to make sure they’re clear. The ransomware decryption key unlocking the enterprise in hours moderately than days can reduce enterprise disruption and lack of income. Then additionally issue within the affect of an insurance coverage underwriter, who too will wish to reduce their prices and take the trail that minimizes any declare that could be made by the sufferer firm.

After all, each rapid and long-term downsides are simply as apparent. The fee might purchase time and lower the invoice – till it does not. For starters, there is no assure that the decryption key will really unlock the info. As well as, the victims that conform to ransom calls for could also be seen by attackers as value concentrating on once more and, finally, they could additionally inadvertently validate and reinforce ransomware as a viable ‘enterprise mannequin’.

The ransomware operators are additionally involved about status – they should be seen as reliable and to be identified for upholding their finish of any deal. When large quantities of delicate knowledge is exfiltrated and held to ransom, in addition to inner techniques encrypted and acquired to a standstill, any negotiation to unlock techniques and make sure the safety of the info must be from a belief standpoint.

If the negotiator has heard damaging critiques on the ransomware group not offering decryptors or holding onto knowledge, they could advise the sufferer to not pay. It’s necessary that when handing over the extortion fee the ransomware group delivers precisely as anticipated, offering the service they’re being paid for in an expert method. The actual problem for any ransomware group just isn’t that of community entry or the exfiltration of knowledge however moderately whether or not the sufferer trusts them sufficient to pay the extortion demand.

Curiously, the operations by regulation enforcement to take down LockBit in 2024 additionally included a marketing campaign to destroy belief within the gang, publicly stating that the gang goes not delete exfiltrated knowledge however maintain on to it. This mistrust marketing campaign could possibly be sufficient for associates to take their alternatives and enterprise to a different group.

What units the worth

My takeaway from the presentation was not one thing the presenter said outright – it’s in regards to the knowledge and reconnaissance the affiliate conducts in regards to the firm. There was a quick point out of the analysis and transferring round an organization community on the lookout for delicate knowledge, together with monetary knowledge which will point out willingness to pay or an quantity that may be acceptable.

This triggered a lightbulb second: essentially the most precious doc to a cybercriminal could possibly be the schedule detailing the corporate’s cyber insurance coverage protection. Understanding whether or not the corporate has insurance coverage that features paying an extortion demand and what the extent of protection is gives the cybercriminal the data on the place to set the extortion demand, in order that the chance turns into a monetary problem not for the corporate, however for the insurer.

The takeaway is that the cyber insurance coverage coverage and all communication relating to the coverage ought to be segmented with further safety, or utterly air-gapped from the corporate community.