Ransomware negotiations have quietly become an AI-versus-AI contest. On one side, cybersecurity firms are using AI tools to study hundreds of past negotiations and spot behavioral patterns in specific hacking crews. On the other, some ransomware gangs have started deploying their own AI chatbots to pressure victims directly, automating a process that used to require a human extortionist typing out threats in real time.
Surefire Cyber, a cybersecurity firm, introduced an AI tool earlier this year that helps its staff tailor negotiation tactics based on lessons drawn from past engagements with different cybercrime groups. The system can analyze hundreds of negotiations at once, surfacing patterns that would be nearly impossible for a single human negotiator to track across dozens of cases involving different hacking crews with different habits.
Those patterns turn out to matter a great deal in practice. In negotiations with Russian-speaking hacking groups, the AI-informed approach revealed that these crews tend to respond badly to low-ball counteroffers, can become visibly infuriated if left waiting too long for a response, and often still have room to bargain even after offering to split the difference, nuances that shape exactly how aggressively and how quickly a negotiator should push back.
On the attacker side, the shift toward AI has been just as direct. At least one ransomware-as-a-service operation has built an AI-powered chatbot directly into its victim negotiation panel, automating communication and applying psychological pressure without requiring a human operator to be present for every conversation. Chat transcripts reviewed by researchers show these bots demanding upward of $1 million at a time, adjusting figures based on data about the victim's apparent willingness and ability to pay, gathered during the attack itself.
The scale this unlocks for attackers is significant. AI-driven negotiation bots can handle hundreds of victim conversations simultaneously, giving ransomware gangs a kind of exponential reach that human negotiators, who can realistically only run a handful of extortion conversations at once, never had. Researchers studying the trend describe AI as currently functioning as an operational force multiplier for existing ransomware tactics rather than introducing an entirely new category of attack.
Human oversight hasn't disappeared on the criminal side; hackers typically still review what their chatbots are saying and make the final calls on deadlines and data-leak threats. But the direction of travel is clear: AI is compressing both how quickly attackers can pressure victims at scale and how precisely defenders can calibrate their response, turning what was once a largely improvised, high-stakes human negotiation into something closer to an algorithmic arms race on both sides of the table.
