Never negotiate with criminals! Insights about ransomware tactics used with victims in the negotiations.

RaaS (Ransomware as a Service) operations allow group operators and affiliates to obtain large sums of money with operations. Depending on the level of victims achieved by the affiliates, the reputation and payments that will be made will vary in percentages with respect to other affiliates participating in that operation. One of the keys to success in RaaS is the negotiation part with the victims. Traditionally, communication with the victims had been carried out through ransom notes, however, currently, the developers of the RaaS groups have developed chat platforms in which the negotiations take place live with the operators of the campaign. In this talk we will compare the negotiations and tactics used by these groups, as well as the chat platforms used to negotiate with the victims in order to understand how these groups work.