Ransomware Syndicates: A New Era of Sophistication
Similar to the events that unfolded with the Conti ransomware group’s demise in 2022, leaked internal chat logs of the Black Basta cybercrime group last year gave us a peek behind the curtain of modern ransomware operations. We found that these groups have continued to evolve into highly sophisticated and organized syndicates, taking a corporate-style approach to extortion.
According to our analysis, Black Basta members carefully studied victims to launch advanced phishing and malware campaigns, exploit vulnerabilities and intimidate victims into paying via panic-triggering tactics. They were exceptionally organized: A call team responsible for social engineering schemes worked a set schedule from 6 p.m. to 2 a.m. Moscow time. Additional tasks were outsourced to third parties — malware services, phone operators and spammers — as if they were hiring contractors.
Internal Performance Assessments and Profit Sharing
Internal performance assessments weighed heavily in determining wages and ransom payment distributions to teams, just like profit sharing in the corporate world. Before shutting down in 2025, Black Basta launched attacks against 520 victims in 39 industries using two dozen ransomware variants, collecting at least $107 million in bitcoin payments.
The leaked chat logs illustrate that ransomware — which now amounts to a $74 billion global industry annually — has matured far beyond its isolated, primitive beginnings. The negotiation phase has emerged as a deliberate part of the attackers’ business model, taking up to two weeks so they can escalate pressure while giving targeted organizations a narrow window to make coordinated decisions.
Personalization and Pressure Tactics
Negotiations are also becoming more customized to the victim, with tiered pricing models based on the company’s size, along with data audits of the compromised information with respect to value and sensitivity. The entire modern ransomware experience appears sharply influenced by two ever-developing components: Personalization and Pressure Tactics.
- Reconnaissance and post-compromise assessments are driving how adversaries set and adjust their payoff demands.
- Cyber insurance actually acts as a “pricing signal,” lending insights into the victim organization’s financial means, willingness to pay and likely ransom amount boundaries during negotiations.
Pressure tactics include standard file encryption and data exfiltration, while adding layers like distributed denial-of-service (DDoS) attacks, operational disruption and third-party harassment. The aforementioned data audits give ransomware groups a more precise valuation of the stolen data, helping them further force victims to pay during negotiations.
Specialization and the Expanding Cybercriminal Ecosystem
The presence of an increasingly expanding cybercriminal ecosystem enhances these personalization and pressure tactics, with ransomware groups able to hire internal workers or outside support for initial access, data theft, victim profiling, stolen data analysis, DDoS/harassment and payment facilitation. This reflects a broader shift toward specialization.
Responding to Ransomware Syndicates
So how should organizations, typically the chief information security officer (CISO), respond? By incorporating the following best practices into their cyber defense strategies:
- Understand the options and risks. Often CISOs must decide between two terrible options: pay a ransom or face reputational or operational damage.
- Understand the criminal ecosystem. Maintain awareness of ransomware trends. Track the new, the growing and the mature ransomware operations.
- Prepare and rehearse. Use all available information to prepare for a ransomware incident. This will allow CISOs to make better, cooler-headed decisions under pressure.
With this understanding, security teams gain insight into how they can more effectively conduct negotiations in real time. As a result, they will ensure their organizations survive these incidents with minimal operational damage and financial losses while discouraging cybercriminals from future attack attempts.
Source: CyberScoop