Hacked by Words: A Live Ransomware Negotiation

Hacked by Words: A Live Ransomware Negotiation

Speakers: Alexa-Ștefana Josephs (HIVEHACK)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=cQ2OHeY4AQw

Overview

In "Hacked by Words: A Live Ransomware Negotiation," Alexa-Ștefana Josephs of HIVEHACK presents a compelling argument for the critical role of strategic communication and human psychology in the modern cybersecurity landscape, particularly concerning ransomware attacks. Moving beyond purely technical defenses, Josephs delves into how attackers exploit cognitive biases and emotional responses, and how trained communicators can leverage psychological principles to effectively negotiate with threat actors and protect organizational trust. The talk culminates in a unique live demonstration where audience members engage with an AI-powered ransomware negotiation bot, showcasing the practical application of these insights.

This presentation challenges the conventional view that incident response is solely a technical discipline, asserting that communication is a core, indispensable component. Josephs, with her background in psychology and communication, bridges the gap between technological defenses and human vulnerabilities, illustrating how understanding persuasion, language patterns, and emotional manipulation is as vital as understanding network protocols or malware signatures. The talk emphasizes that in an era where human-based attacks are rampant, protecting an organization's reputation and trust often hinges on its ability to communicate clearly, calmly, and strategically under duress.

The significance of Josephs' work lies in its timely recognition of the human element as both the weakest link and a potential point of strength in cybersecurity. Drawing inspiration from major incidents like the CrowdStrike event in July 2024, which affected 8.5 million computers, she highlights the profound impact of organizational communication during a crisis. By demonstrating how psychological tactics are used by attackers and how they can be countered by skilled negotiators, Josephs provides a crucial framework for organizations to build more resilient incident response plans that encompass both technical and human-centric defenses.

Background

▶ Watch: Introduction: Psychology and communication in cyber security (0:00)

The landscape of cyber threats has evolved dramatically, with ransomware emerging as one of the most disruptive and costly forms of attack. The increasing sophistication of ransomware operations, coupled with the sheer volume of incidents, has necessitated a re-evaluation of traditional defense strategies. While technical solutions remain paramount, Alexa-Ștefana Josephs argues that the human element, often overlooked, is equally critical. The speaker's journey into this field was galvanized by the significant CrowdStrike incident on July 19, 2024, which impacted 8.5 million computers and critical services. While technical details were extensively analyzed, Josephs found herself wondering about the human aspect: "what did they tell the people and who stood in front of the cameras when people were demanding answers?" This curiosity led her to realize that strategic communication is not merely a public relations skill but a fundamental pillar of any robust incident response plan.

Josephs' background in psychology and communication, combined with a fascination for cybersecurity, provided a unique lens through which to analyze this problem. She posits that "technology doesn't fail, people do," underscoring the pervasive influence of human behavior in security incidents. This perspective aligns with the understanding that many successful attacks, especially ransomware, involve significant human-based vectors, such as phishing, social engineering, and direct manipulation during negotiation. The financial stakes are immense; industry reports, such as those from Sophos, place the average recovery cost for a ransomware incident around $1.5 million, with some ransoms themselves exceeding seven figures. Coveware also reported quarterly average payments spiking into the million-dollar range in 2025, highlighting the severe economic impact.

To illustrate how deeply human psychology is intertwined with susceptibility to attacks, Josephs introduces several cognitive biases. The Kiki and Bouba test demonstrates how our brains automatically connect sounds, shapes, and emotions, showing how attackers can manipulate perception through language and design to evoke trust or panic. The Stroop effect reveals cognitive interference, where automatic processes (like reading a word) override conscious instructions (like naming its color). This explains why, under stress, individuals "react before they think," clicking before checking or forwarding before verifying—a prime vulnerability for phishing and social engineering. Finally, the Halo effect illustrates how a visible trait can subconsciously alter our overall perception of something or someone. In a crisis, this translates to how a calm, composed spokesperson can maintain brand trust, even with limited information, whereas a panicked one can erode it, regardless of technical efforts. These psychological "features of the human mind," as Josephs calls them, are routinely exploited by attackers, propagandists, and "crisis mismanagers," making an understanding of psychology a crucial "first layer of defense" in cybersecurity.

Key Findings

▶ Watch: Ransomware negotiation is pure psychology (10:00)

The central premise of Alexa-Ștefana Josephs' talk is that ransomware negotiation is fundamentally a psychological battle, not merely a technical exchange of files and keys. Her extensive analysis of ransom chat transcripts revealed recurring patterns of manipulation employed by attackers and effective countermeasures utilized by skilled negotiators. The key findings illuminate how understanding these psychological dynamics can significantly alter the outcome of a ransomware incident.

Josephs identified a predictable toolkit of manipulation techniques used by attackers:

• Urgency and Scarcity: Attackers impose strict deadlines, such as "48 hours" or "final 12 hours window," to force rushed, emotional decisions from victims.
• Authority Impersonation: They often use technical jargon or claim legitimacy (e.g., "sod leaguer") to appear authoritative and impressive, intimidating the victim.
• Anchoring: An astronomical opening demand for ransom is set, making any subsequent "discount" seem reasonable and creating a psychological anchor for negotiation.
• Reciprocity: Attackers might offer small gestures, such as deleting a sample or returning one file, to create a false sense of goodwill and obligation.
• Isolation: They prefer to communicate with a single, panicked individual, isolating them from legal, forensic, or internal support teams to maximize psychological pressure.
• Social Leverage: Attackers invoke the threat of involving press partners or downstream customers to amplify reputational stakes and pressure the victim into compliance.

Conversely, Josephs found that trained negotiators reliably dismantle these levers through a set of strategic communication tactics:

• Slowing the Tempo: This crucial step breaks the attacker's imposed urgency, allowing the victim organization to think clearly and coordinate a response.
• Centralizing Communication: All communication is funneled through a single, official voice, removing emotional, disparate replies and presenting a unified front.
• Demanding Verifiable Proof: Negotiators insist on concrete evidence of data exfiltration or encryption, often requesting specific files or data samples. This shifts the burden of proof to the attacker and introduces a structured, objective exchange.
• Escrow Mechanics: Introducing formal payment mechanisms or conditions signals a professional, controlled approach, further eroding the attacker's leverage.
• Introducing Legal and Law Enforcement Friction: Mentioning involvement of legal counsel or law enforcement agencies raises the risk profile for the attacker, signaling that the victim is not an easy target.

These counter-tactics do more than just buy time; they fundamentally change the attacker's incentives. By shifting the dynamic from panic to process, negotiators force attackers to convert their "narrative power into verifiable outcomes," a domain where attackers are often weakest. This reframing of the emotional exchange with structure effectively "bleeds value off the attacker's threat." The overarching finding is that strategic communication is a psychological defense, an essential, non-optional component of incident response that protects trust and brand image, complementing technological safeguards.

Technical Deep Dive

▶ Watch: Attacker tactics vs. negotiator counter-strategies (14:00)

While "Hacked by Words" is not a traditional technical talk focused on exploits or system architectures, its "technical deep dive" resides in the meticulous analysis of the psychological protocols and architectures of human-based attacks and defenses. Josephs meticulously dissects the mechanisms by which attackers manipulate victims and the structured, deliberate counter-mechanisms employed by expert negotiators. This constitutes a "technical" understanding of human interaction in a high-stakes cyber crisis.

The attacker's "toolkit" can be viewed as a set of social engineering primitives designed to exploit well-known cognitive biases:

1. Urgency and Scarcity Primitives: Attackers consistently employ time-bound threats, such as "48 hours to pay" or "final 12-hour window before data is leaked." This directly exploits the scarcity principle and loss aversion, compelling victims to act impulsively. The technical implementation of this is through immediate, aggressive messaging in the initial ransom note or chat.
2. Authority Impersonation Primitives: Threat actors often craft messages that mimic official communications or use technical jargon to establish a false sense of legitimacy and expertise. This leverages the authority bias, where individuals are more likely to comply with perceived authorities. The mention of "Sod Leaguer" as an example of a group name that sounds legitimate, combined with complex-sounding technical language, serves to overwhelm and intimidate non-technical recipients.
3. Anchoring Primitives: The initial ransom demand is almost always astronomically high. This anchoring effect ensures that any subsequent, lower offer appears reasonable by comparison, even if still exorbitant. It psychologically frames the negotiation in the attacker's favor from the outset.
4. Reciprocity Primitives: Attackers might offer a small concession, like deleting a sample file or providing a single decrypted file as "proof of life." This exploits the rule of reciprocity, making the victim feel obligated to reciprocate with cooperation or payment.
5. Isolation Primitives: Attackers actively try to isolate the primary contact person, demanding communication with a "single panicked individual." This prevents the victim from consulting legal, forensic, or internal experts, thereby minimizing external support and maximizing the effectiveness of other psychological pressures.
6. Social Leverage Primitives: Threats to involve "press partners" or expose data to "downstream customers" leverage the fear of reputational damage. This exploits the victim's concern for social standing and brand image, escalating the perceived consequences beyond financial loss.

Against these psychological attack vectors, trained negotiators deploy a structured set of defensive protocols:

1. Tempo Deceleration Protocol: The first and most critical countermeasure is to deliberately slow the tempo of communication. This directly undermines the attacker's urgency primitive, allowing the victim organization to move from an emotional, reactive state to a rational, proactive one. This involves delayed responses, requests for clarification, and pushing back on arbitrary deadlines.
2. Centralized Communication Architecture: Establishing a single official voice for all communications is vital. This prevents multiple, potentially contradictory, or emotionally charged responses, presenting a unified, professional front. It also prevents the attacker from exploiting internal disarray.
3. Verifiable Proof Demands: Negotiators systematically demand verifiable proof of compromise, such as specific data samples or decryption tests. This shifts the burden of proof to the attacker, introduces objective criteria into the negotiation, and ensures that any payment is tied to a tangible outcome. This also helps to validate the attacker's claims and understand the scope of the breach.
4. Escrow Mechanics Integration: Introducing the concept of escrow mechanics for payment demonstrates a structured, controlled approach to the transaction. It signals that the victim is not simply capitulating but is engaging in a formal, conditional process, which can further erode the attacker's sense of control.
5. Legal and Law Enforcement Friction Introduction: Explicitly mentioning the involvement of legal counsel and law enforcement agencies introduces friction for the attacker. This signals that the incident is being handled by professionals and may increase the perceived risk for the threat actor, potentially making them more willing to negotiate for a lower sum or to disengage.

These defensive protocols are designed to "reframe emotion" and replace "raw emotion with structure." By doing so, they dismantle the attacker's psychological levers one by one. The core "technical" insight here is that when attackers are forced to convert their "narrative power into verifiable outcomes," their leverage diminishes, as their primary strength lies in psychological manipulation rather than transparent, verifiable engagement. This systematic approach transforms a chaotic, fear-driven interaction into a more controlled, data-driven negotiation.

Demo / Proof of Concept

▶ Watch: Strategic communication is core to incident response (24:00)

The practical application of Josephs' research culminated in a compelling live demonstration of a ransomware negotiation with an AI-powered bot. Recognizing the need for hands-on training, she developed a tool called White Bun, a ChatGPT-based bot specifically designed to impersonate a ransomware attacker.

The White Bun bot was meticulously crafted by Josephs using a custom prompt, trained on a wealth of real-world ransom chat transcripts. She explicitly mentioned sourcing these transcripts from "two really good websites" that aggregate such data, allowing the AI to learn the language patterns, rhythms, and specific manipulation tactics employed by various ransomware groups. This training enabled the bot to realistically simulate an attacker's behavior, including their initial demands, responses to negotiation attempts, and the psychological ploys they typically use. The primary goal of this bot is to serve as a training tool for employees and colleagues, allowing them to practice ransomware negotiation skills in a safe, controlled environment.

During the live demonstration, Josephs invited volunteers from the audience to engage with White Bun, simulating a real-time Telegram chat with an attacker. The scenario presented was a typical ransomware demand: a fixed amount of money and a strict "48-hour" deadline. Audience members were encouraged to suggest their initial responses and negotiation tactics.

Several notable interactions occurred:

• Negotiating Price: An early volunteer immediately asked, "Is the price negotiable? How can we reduce the price?" The bot's response, "Our initial demand stands firm," mirrored the typical initial rigidity of attackers.
• Requesting More Time: Another participant requested more than 48 hours, suggesting "at least a week to get 500,000." This is a common tactic to slow the tempo.
• Demanding Proof of Files: A crucial step, a volunteer asked, "Can you show me proof of the files or that you have access to my files?" This aligns with the negotiator's tactic of demanding verifiable proof.
• Leveraging Backups: A particularly effective suggestion involved threatening the attacker with the existence of "offline backup servers they don't know about." This tactic successfully led to a 15% price reduction from the bot, demonstrating the AI's ability to respond to genuine leverage.

Josephs also shared an anecdote about one of her students who managed to "bypass the chat" by appealing to empathy. The student claimed to be in the hospital, lacking funds, and even asked the bot for "half a million dollars" to pay the ransom, to which the bot responded "yes." This anecdote, while humorous, highlighted both the current limitations of AI in fully replicating complex human empathy and the potential for creative, unconventional negotiation tactics.

The demonstration effectively served as a proof of concept for the utility of AI in cybersecurity training. It showed that such tools can:

• Provide a realistic, interactive environment for practicing high-stress communication.
• Expose participants to common attacker tactics and psychological pressures.
• Allow individuals to experiment with different negotiation strategies and observe their immediate impact.

Josephs emphasized that while they "don't support negotiating with the attacker" as a primary strategy, in situations where it becomes necessary, "it is better to know what to do than to have no clue." The White Bun bot offers a scalable and accessible way to impart this crucial knowledge.

Defensive Implications

▶ Watch: Q&A: Train technical teams in communication (27:00)

The insights presented in "Hacked by Words" carry profound defensive implications for organizations facing the ever-present threat of ransomware and other human-based attacks. The core message is a paradigm shift: cybersecurity defense must extend beyond technical controls to encompass robust strategic communication and psychological preparedness.

Firstly, organizations must recognize that strategic communication is a core component of the incident response plan, not an afterthought or a mere public relations function. This means integrating communicators directly into the incident response team (IRT) from the outset. These communicators need to be media-trained and understand the nuances of messaging during a crisis. Their role is to manage external perception, maintain stakeholder trust, and ensure consistent, clear messaging, which can significantly mitigate reputational damage, as demonstrated by the Halo effect. Just as technical teams work to contain the breach, communicators work simultaneously to contain the narrative.

Secondly, there is a critical need to train technical teams in effective communication. Josephs argues that while it's challenging for communicators to grasp deep technical intricacies, it's often "easier to pretty much train your technical people to become really good public speakers than to pretty much train your public speakers into becoming technical people." Technical staff, who possess the most accurate information about an incident, must be able to translate complex technical details into "easy to digest language" for internal stakeholders, leadership, legal teams, and potentially the public. This improves internal coordination, streamlines decision-making, and fosters a more transparent and trustworthy response.

Thirdly, organizations must proactively understand and counter psychological vulnerabilities. Training should educate employees about common cognitive biases like the Stroop effect (reacting before thinking) and the Kiki/Bouba test (associating meaning automatically). This awareness helps employees recognize and resist social engineering tactics, such as urgent deadlines, authoritative language, or manipulative gestures, which are frequently employed by attackers. By understanding how their brains can be exploited, individuals are better equipped to challenge suspicious communications.

Fourthly, proactive ransomware negotiation training is essential. While paying a ransom is generally discouraged, the reality is that some organizations may find themselves in a position where negotiation is the only viable path to recovery. Tools like the White Bun bot offer a safe environment to practice these high-stakes conversations. Training negotiators to slow the tempo, centralize communication, demand verifiable proof, and introduce legal friction can significantly reduce ransom payments and improve recovery outcomes. Knowing these tactics provides an advantage, ensuring the organization is "better to know what to do than to have no clue."

Finally, the overarching defensive implication is the recognition of strategic communication as a psychological defense layer. Technology protects systems, but strategic communication protects trust—the most valuable asset for any organization. By investing in communication expertise and training, companies can build resilience against information warfare, manage public perception effectively during crises, and ultimately safeguard their long-term reputation and operational continuity.

Key Takeaways

• Strategic communication is a core incident response function, not just a PR skill. It is essential for protecting organizational trust and brand image during and after cyber incidents.
• Human psychology and cognitive biases are actively exploited by attackers. Understanding concepts like the Stroop effect, Halo effect, and Kiki/Bouba test helps organizations recognize and counter manipulative tactics.
• Ransomware negotiation is a psychological battle where language is leverage. Attackers use predictable manipulation techniques (urgency, anchoring, isolation, reciprocity), which can be systematically dismantled.
• Trained negotiators can significantly alter the outcome of ransomware incidents. By slowing the tempo, centralizing communication, demanding verifiable proof, and introducing legal friction, they can reduce costs and regain control.
• Organizations must integrate communicators into their IR teams and train technical staff in effective communication. This bridges the gap between technical understanding and clear, trustworthy messaging for all stakeholders.
• AI-powered tools like the "White Bun" bot offer valuable, realistic training for ransomware negotiation. They allow employees to practice high-stakes communication in a safe environment, preparing them for real-world scenarios.

About the Speaker(s)

Alexa-Ștefana Josephs is a strategic communicator at HIVEHACK, dedicated to bridging the critical gap between technology and trust in the cybersecurity domain. With a strong academic foundation, holding a Bachelor's degree in Psychology and a Master's in Communication, she brings a unique, human-centric perspective to complex technical challenges. Josephs' work is driven by a fascination with emerging technologies and cybersecurity, which she combines with her expertise in communication, advertising, and marketing. Her research and presentations, such as "Hacked by Words," highlight the indispensable role of human psychology and strategic messaging in incident response, crisis management, and understanding how trust is built and broken in the digital space. She advocates for integrating communication experts into cybersecurity teams and equipping technical professionals with essential communication skills.