GPSEC Greatest Hits:
Talking TACOs: Insights From the Front Lines of Ransomware Negotiations

Talking TACOs: Insights From the Front Lines of Ransomware Negotiations

In this session, two experienced ransomware negotiators provide a technical, behind-the-scenes look at Threat Actor Communications (TACOs) during live ransomware incidents. Drawing on extensive field experience, we break down negotiation methodology, decision frameworks, and the structured, intelligence-driven approach used to manage risk and influence outcomes. We analyze communication patterns across major ransomware syndicates and emerging groups, contrasting standard engagements with anomalous cases that required adaptive strategy. Using real data, we demonstrate how disciplined, tactical communications can reduce financial impact and operational damage. We also share first-hand insights from two cases tied to the collapse of RansomHub, including suspected affiliate fraud during high-value ransom negotiations.

Speakers:
Justin Timothy, Principal Threat Intelligence Consultant, GuidePoint Security
Ryan Silver, Threat Intelligence Consultant, GuidePoint Security

SEE THE FULL SCHEDULE HERE