Similar to the events that unfolded with the Conti ransomware group’s demise in 2022, leaked internal chat logs of the Black Basta cybercrime group last year gave us a peek behind the curtain of modern ransomware operations. We found that these groups have continued to evolve into highly sophisticated and organized syndicates, taking a corporate-style approach to extortion.

According to our analysis, Black Basta members carefully studied victims to launch advanced phishing and malware campaigns, exploit vulnerabilities and intimidate victims into paying via panic-triggering tactics. They were exceptionally organized: A call team responsible for social engineering schemes worked a set schedule from 6 p.m. to 2 a.m. Moscow time. Additional tasks were outsourced to third parties — malware services, phone operators and spammers — as if they were hiring contractors. Internal performance assessments weighed heavily in determining wages and ransom payment distributions to teams, just like profit sharing in the corporate world.

Before shutting down in 2025, Black Basta launched attacks against 520 victims in 39 industries using two dozen ransomware variants, collecting at least $107 million in bitcoin payments.

The leaked chat logs illustrate that ransomware — which now amounts to a $74 billion global industry annually — has matured far beyond its isolated, primitive beginnings. The negotiation phase has emerged as a deliberate part of the attackers’ business model, taking up to two weeks so they can escalate pressure while giving targeted organizations a narrow window to make coordinated decisions.

Negotiations are also becoming more customized to the victim, with tiered pricing models based on the company’s size, along with data audits of the compromised information with respect to value and sensitivity.

The entire modern ransomware experience appears sharply influenced by two ever-developing components:

Personalization. Reconnaissance and post-compromise assessments are driving how adversaries set and adjust their payoff demands. As part of the process, they look closely at revenue and financial position, contracts and customer relationships, board-level communications, backup and recovery capabilities, sensitivity levels of data and cyber insurance policy details. Cyber insurance actually acts as a “pricing signal,” lending insights into the victim organization’s financial means, willingness to pay and likely ransom amount boundaries during negotiations.

Pressure tactics. Multi-extortion execution is turning up the heat on targeted companies. This includes standard file encryption and data exfiltration, while adding layers like distributed denial-of-service (DDoS) attacks, operational disruption and third-party harassment. The aforementioned data audits give ransomware groups a more precise valuation of the stolen data, helping them further force victims to pay during negotiations.

The attackers will also intentionally manipulate deadlines to maximize their odds of success. They may first set a tight deadline to create urgency, then extend it if they sense doing so will result in a more certain payday. Or they could take the opposite approach by compressing deadlines from days to mere hours to inspire a panic-led decision to meet the ransom demand.

The presence of an increasingly expanding cybercriminal ecosystem enhances these personalization and pressure tactics, with ransomware groups able to hire internal workers or outside support for initial access, data theft, victim profiling, stolen data analysis, DDoS/harassment and payment facilitation. This reflects a broader shift toward specialization.

So how should organizations, typically the chief information security officer (CISO), respond? By incorporating the following best practices into their cyber defense strategies:

Understand the options and risks. Often CISOs must decide between two terrible options: pay a ransom or face reputational or operational damage. In some countries, sending money to a sanctioned entity is illegal, and though paying a ransom demand may not be universally illegal, it is regularly discouraged by law enforcement as it incentivizes future malicious activity. However, not paying a ransom could impact not only immediate operations, but also long-term organizational growth.

Understand the criminal ecosystem. Maintain awareness of ransomware trends. Track the new, the growing and the mature ransomware operations. Require the cyber threat intelligence (CTI) function to keep CISOs apprised of the ransomware threat. Through established relationships, CISOs should gather information about experiences from peer organizations who have previously been compromised.

Prepare and rehearse. Use all available information to prepare for a ransomware incident. This will allow CISOs to make better, cooler-headed decisions under pressure. They will be less inclined to treat negotiations as an improvised crisis situation and more as a scenario they have planned for and rehearsed, as assisted by threat intelligence.

In classic action moves like “Dog Day Afternoon,” “The Taking of Pelham One Two Three” and “Captain Phillips,” both victims and authorities spend considerable time analyzing their opponents. In modern ransomware incidents, CISOs and other leaders need to take a similar approach to understand how a broad criminal ecosystem, corporate-level structure, multi-extortion techniques, data audits, cyber insurance assessments and deadline manipulation come together to make for a more formidable opponent.

With this understanding, security teams gain insight into how they can more effectively conduct negotiations in real time. As a result, they will ensure their organizations survive these incidents with minimal operational damage and financial losses while discouraging cybercriminals from future attack attempts.