An inside look at how incident response teams are leveraging AI trained on historical chat data to navigate ransomware negotiations, streamline communication rounds, and manage extortion cases.
In a recent incident, a Canadian retail chain based in Montreal experienced a major outage when its network was breached by the notorious Qilin hacking group. The group has made international headlines in the past, including a 2024 attack on a medical diagnostics company in the United Kingdom that demanded a huge ransom and leaked patient medical data. To manage the crisis, the owners of the Canadian business turned to Surefire Cyber, assigning negotiator Joe Tarraf to handle the situation.
Tarraf relied on a specialized in-house AI tool developed by his company, which has been trained on thousands of messages from past anonymized negotiations. This system analyzes the language patterns, response times, and habits of criminal groups, helping negotiators adjust their strategy. According to the company, using this tool has helped reduce the time to reach an agreement by 30%, reducing the number of messages required per case.
During the negotiation that lasted more than two weeks, Tarraf posed as the company’s IT employee, buying critical time for the technical team to locate the point of intrusion and determine which files had been compromised. At the same time, the artificial intelligence tool protected him from betraying his professional status by highlighting repeated phrases he used frequently that could give him away. By focusing on the company’s limited financials and urging the perpetrators to check the real financial records, the negotiation team was finally able to convince the hackers to accept $175.000, an amount partially covered by insurance coverage.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Pharmaceutical company paid ransom in Bitcoin to save customer data
↗
Data from analysts shows that ransom payments remain a widespread problem, while cybersecurity companies continue to experiment with artificial intelligence technologies — such as the creation of fake computer systems by companies like Splunk to deceive attackers. Meanwhile, German authorities have arrested a suspected member of Qilin, highlighting the difficulties and advances in dismantling such cybercrime networks.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)