Dancing with the devil: Evolving the art of threat actor engagement

Businesses impacted by a ransomware or extortion incident are confronted with many difficult decisions – including whether to engage with a threat actor. While the default response for most is to steer clear, the realities of an incident may require a business to carefully consider their position.

We explore the realities of communicating with cybercriminals that have perpetrated an incident, the legal and practical considerations that play into decision making (beyond the question of paying a ransom), the potential benefits and pitfalls of engaging in negotiations with a threat actor and the available approaches.

Leveraging real world examples, we will work through initial thinking and guidance that drives business decision making, the tactical, and regulatory dimensions and the real world implications that arose for business from initiating — or avoiding — a dialogue with threat actors.

We will provide a nuanced look at the risks and rewards of ""talking to the enemy."" This will include stalling tactics to “buy more time”, intelligence gathering to support assessment and reporting obligations, and retaliatory action by threat actors and sanctions concerns.

We will also explore the impact of recent and upcoming regulatory changes in Australia on business decision making around communicating with threat actors and further obligations now in force.

Key Takeaways:

Intended Audience: