[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOFzUU0Rq0O6pLg4Qchd5zW_DkXP7vJpnQ5OtwB1ZLCE":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":73},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":24},"66a4356a-c224-491b-adef-da0f45ecd4ee","When Your Ransomware Negotiator Works for the Other Side","when-your-ransomware-negotiator-works-for-the-other-side-dfbbec","The shocking arrest of a well-known ransomware negotiator reveals the critical need for vendor program oversight.","A prominent ransomware negotiator has been arrested, accused of secretly collaborating with the very cybercriminal groups he was hired to negotiate with. This revelation highlights a significant vulnerability in the ransomware ecosystem, where trust is paramount and the potential for insider threats is substantial. The incident underscores the critical need for robust oversight and due diligence when engaging third-party negotiators or incident response firms.","Ransomware negotiator arrested for allegedly working with attackers.","https:\u002F\u002Fwww.darkreading.com\u002Fcyber-risk\u002Fwhen-your-ransomware-negotiator-works-other-side","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt6c22b787d3880a22\u002F6a469e8782b5bc23f1d3a21e\u002Fransomware-Just_Super-Getty-1399980046.jpg?width=720&quality=80&disable=upscale","2026-10-16T14:00:00+00:00","2026-10-16T14:00:15.255421+00:00",8,[17],{"name":18,"type":19},"ransomware","threat_actor","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":20,"icon":22,"name":23,"slug":18},null,"Ransomware",[25,30,35],{"category":26},{"id":27,"icon":22,"name":28,"slug":29},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":31},{"id":32,"icon":22,"name":33,"slug":34},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":36},{"id":37,"icon":22,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":43,"vendors":72},[44],{"slug":45,"name":46,"problem":47,"products":48},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[49,57,65],{"vendor_slug":50,"vendor_name":51,"vendor_logo":52,"product_slug":53,"product_name":54,"url":55,"description":56},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":34,"product_name":69,"url":70,"description":71},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":74,"title":75,"body":76,"framework_refs":77,"framework_notes":86},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","A trusted ransomware negotiator was arrested for covertly collaborating with the very criminal groups he was paid to negotiate against, representing a severe insider threat within the incident response supply chain. Organizations under attack are inherently vulnerable and place enormous trust in third-party responders, creating a high-value target for adversarial infiltration or corruption. This case demonstrates that the incident response ecosystem itself can be compromised, meaning that sensitive data shared during negotiations — including financial limits, recovery status, and backup availability — may have been weaponized against victims. Vetting and continuous oversight of third-party responders is not optional; it is a critical security control in its own right.",[78,79,80,81,82,83,84,85],"NIST CSF ID.SC-2 (Supply Chain Risk Management)","NIST SP 800-161 (Supply Chain Risk Management Practices)","NIST IR-4 (Incident Handling)","CIS Control 17 (Incident Response Management)","CIS Control 15 (Service Provider Management)","ISO 27001 A.15.1 (Information Security in Supplier Relationships)","GDPR Article 28 (Processor Obligations and Due Diligence)","ITIL Service Transition – Supplier Management Process",{}]