{"id":"https://openalex.org/W7131652337","doi":"https://doi.org/10.1016/j.chb.2026.108953","title":"Engaging with cybercriminals: phases and influence strategies in ransomware negotiations","display_name":"Engaging with cybercriminals: phases and influence strategies in ransomware negotiations","publication_year":2026,"publication_date":"2026-02-26","ids":{"openalex":"https://openalex.org/W7131652337","doi":"https://doi.org/10.1016/j.chb.2026.108953"},"language":"en","primary_location":{"id":"doi:10.1016/j.chb.2026.108953","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.chb.2026.108953","pdf_url":null,"source":{"id":"https://openalex.org/S204030396","display_name":"Computers in Human Behavior","issn_l":"0747-5632","issn":["0747-5632","1873-7692"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers in Human Behavior","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.chb.2026.108953","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126864700","display_name":"Michail Georgiou","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":true,"raw_author_name":"Michail Georgiou","raw_affiliation_strings":["Section of Psychology of Conflict, Risk and Safety, University of Twente, Enschede, The Netherlands"],"affiliations":[{"raw_affiliation_string":"Section of Psychology of Conflict, Risk and Safety, University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123299646","display_name":"Ellen Giebels","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Ellen Giebels","raw_affiliation_strings":["Section of Psychology of Conflict, Risk and Safety, University of Twente, Enschede, The Netherlands"],"affiliations":[{"raw_affiliation_string":"Section of Psychology of Conflict, Risk and Safety, University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079552816","display_name":"Miriam S. D. Oostinga","orcid":"https://orcid.org/0000-0002-8189-2690"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Miriam S.D. Oostinga","raw_affiliation_strings":["Section of Psychology of Conflict, Risk and Safety, University of Twente, Enschede, The Netherlands"],"affiliations":[{"raw_affiliation_string":"Section of Psychology of Conflict, Risk and Safety, University of Twente, Enschede, The Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5119336940","display_name":"Remco Spithoven","orcid":null},"institutions":[{"id":"https://openalex.org/I2801398864","display_name":"Saxion","ror":"https://ror.org/005t9n460","country_code":"NL","type":"education","lineage":["https://openalex.org/I2801398864"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Remco Spithoven","raw_affiliation_strings":["Research Group of Online Resilience, Saxion University of Applied Sciences, Apeldoorn, The Netherlands"],"affiliations":[{"raw_affiliation_string":"Research Group of Online Resilience, Saxion University of Applied Sciences, Apeldoorn, The Netherlands","institution_ids":["https://openalex.org/I2801398864"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5126864700"],"corresponding_institution_ids":["https://openalex.org/I94624287"],"apc_list":{"value":3440,"currency":"USD","value_usd":3440},"apc_paid":{"value":3440,"currency":"USD","value_usd":3440},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.71561113,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"181","issue":null,"first_page":"108953","last_page":"108953"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.43700000643730164,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.43700000643730164,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.3089999854564667,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12221","display_name":"Cybersecurity and Cyber Warfare Studies","score":0.05700000002980232,"subfield":{"id":"https://openalex.org/subfields/3320","display_name":"Political Science and International Relations"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ransom","display_name":"Ransom","score":0.890999972820282},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.8809999823570251},{"id":"https://openalex.org/keywords/negotiation","display_name":"Negotiation","score":0.7261000275611877},{"id":"https://openalex.org/keywords/payment","display_name":"Payment","score":0.45590001344680786},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4115999937057495},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.37380000948905945}],"concepts":[{"id":"https://openalex.org/C2781426709","wikidata":"https://www.wikidata.org/wiki/Q1414572","display_name":"Ransom","level":2,"score":0.890999972820282},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.8809999823570251},{"id":"https://openalex.org/C199776023","wikidata":"https://www.wikidata.org/wiki/Q202875","display_name":"Negotiation","level":2,"score":0.7261000275611877},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5135999917984009},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.46799999475479126},{"id":"https://openalex.org/C145097563","wikidata":"https://www.wikidata.org/wiki/Q1148747","display_name":"Payment","level":2,"score":0.45590001344680786},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4180000126361847},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4115999937057495},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.37380000948905945},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.31040000915527344},{"id":"https://openalex.org/C4216890","wikidata":"https://www.wikidata.org/wiki/Q815823","display_name":"Business model","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.2897000014781952},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.28850001096725464},{"id":"https://openalex.org/C198082294","wikidata":"https://www.wikidata.org/wiki/Q3399648","display_name":"Position (finance)","level":2,"score":0.2574000060558319},{"id":"https://openalex.org/C51575053","wikidata":"https://www.wikidata.org/wiki/Q72468","display_name":"Bureaucracy","level":3,"score":0.2558000087738037}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.chb.2026.108953","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.chb.2026.108953","pdf_url":null,"source":{"id":"https://openalex.org/S204030396","display_name":"Computers in Human Behavior","issn_l":"0747-5632","issn":["0747-5632","1873-7692"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers in Human Behavior","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.chb.2026.108953","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.chb.2026.108953","pdf_url":null,"source":{"id":"https://openalex.org/S204030396","display_name":"Computers in Human Behavior","issn_l":"0747-5632","issn":["0747-5632","1873-7692"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers in Human Behavior","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6853989362716675,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":68,"referenced_works":["https://openalex.org/W134812678","https://openalex.org/W1560513650","https://openalex.org/W1986581027","https://openalex.org/W1988452173","https://openalex.org/W1992444044","https://openalex.org/W1994172095","https://openalex.org/W1999489930","https://openalex.org/W2016640185","https://openalex.org/W2025909112","https://openalex.org/W2037781503","https://openalex.org/W2047691574","https://openalex.org/W2066206193","https://openalex.org/W2074796976","https://openalex.org/W2076898331","https://openalex.org/W2077373738","https://openalex.org/W2094629080","https://openalex.org/W2096563449","https://openalex.org/W2121377134","https://openalex.org/W2129535903","https://openalex.org/W2136814922","https://openalex.org/W2144981148","https://openalex.org/W2149908047","https://openalex.org/W2152011420","https://openalex.org/W2153245338","https://openalex.org/W2160686961","https://openalex.org/W2167072713","https://openalex.org/W2271187128","https://openalex.org/W2491610989","https://openalex.org/W2529251251","https://openalex.org/W2556684481","https://openalex.org/W2567205006","https://openalex.org/W2609990009","https://openalex.org/W2734324974","https://openalex.org/W2775078427","https://openalex.org/W2809150229","https://openalex.org/W2900702693","https://openalex.org/W2911311548","https://openalex.org/W2918358662","https://openalex.org/W2955105517","https://openalex.org/W2960902621","https://openalex.org/W2968898131","https://openalex.org/W3009452534","https://openalex.org/W3031749371","https://openalex.org/W3032258369","https://openalex.org/W3046374425","https://openalex.org/W3133399946","https://openalex.org/W3203444100","https://openalex.org/W3208791650","https://openalex.org/W4232840444","https://openalex.org/W4237762599","https://openalex.org/W4241124503","https://openalex.org/W4248512194","https://openalex.org/W4280631595","https://openalex.org/W4286932750","https://openalex.org/W4307562124","https://openalex.org/W4316042120","https://openalex.org/W4366447842","https://openalex.org/W4367183420","https://openalex.org/W4367676153","https://openalex.org/W4378905504","https://openalex.org/W4387059119","https://openalex.org/W4389392882","https://openalex.org/W4390064573","https://openalex.org/W4396888951","https://openalex.org/W4398133485","https://openalex.org/W4404144706","https://openalex.org/W4404361178","https://openalex.org/W4408149857"],"related_works":[],"abstract_inverted_index":{"Ransomware":[0],"is":[1,13,144],"a":[2,11,158],"cybersecurity":[3,196,259],"threat":[4,80,106,178,205,230],"that":[5,44],"holds":[6],"organizations'":[7],"data":[8,143],"hostage":[9],"until":[10],"ransom":[12,28,151],"paid.":[14],"Past":[15],"research":[16],"has":[17,36],"mainly":[18],"focused":[19],"on":[20,67,118],"the":[21,27,40,68,74,93,96,100,133,150,175,199,204],"technical":[22],"aspects":[23],"of":[24,42,70,161,218],"prevention":[25],"or":[26],"payment":[29],"when":[30],"an":[31],"attack":[32],"occurs.":[33],"Little":[34],"attention":[35],"been":[37],"devoted":[38],"to":[39,46,123,146,242,261],"strategies":[41,76,131,164,186,226],"organizations":[43],"lead":[45],"this":[47,50],"payment.":[48],"In":[49],"study,":[51],"we":[52],"analyze":[53],"41":[54],"authentic":[55],"chat":[56],"logs":[57],"from":[58,140],"16":[59],"private":[60],"and":[61,73,82,99,112,121,136,180,187,195,221,232,251],"25":[62],"open-source":[63],"ransomware":[64,71,91,167,208,215],"incidents,":[65],"focusing":[66],"phases":[69,89,137,213],"negotiations":[72],"influence":[75,225],"employed":[77],"by":[78,157,183,228],"both":[79,229],"actors":[81,107,179,206,231],"victims.":[83,233],"The":[84],"analysis":[85,154],"identifies":[86],"three":[87,212],"distinct":[88],"in":[90,166,214],"negotiations:":[92,216],"proof-of-life":[94],"phase,":[95,98],"bargaining":[97],"support":[101],"phase.":[102],"Across":[103],"these":[104,163,190],"stages,":[105],"predominantly":[108],"use":[109],"being":[110],"credible":[111],"direct":[113],"pressure,":[114],"while":[115],"victims":[116],"rely":[117],"rational":[119],"persuasion":[120],"kindness":[122],"secure":[124],"favorable":[125],"terms.":[126],"Both":[127],"parties":[128],"adapt":[129],"their":[130],"as":[132],"negotiation":[134,185,200,239],"progresses":[135],"change,":[138],"moving":[139],"establishing":[141],"what":[142],"stolen":[145],"exchanging":[147],"offers":[148],"about":[149],"amount.":[152],"This":[153,169],"was":[155],"complemented":[156],"qualitative":[159],"exploration":[160],"how":[162],"manifest":[165],"negotiations.":[168,253],"paper":[170],"provides":[171],"key":[172],"insights":[173,257],"into":[174],"dynamics":[176,191],"between":[177,248],"victim":[181],"companies":[182],"outlining":[184],"stages.":[188],"Understanding":[189],"better":[192],"prepares":[193],"decision-makers":[194],"experts":[197],"for":[198,258],"communication":[201],"process":[202],"with":[203],"following":[207],"attacks.":[209],"\u2022":[210,223,234,245,254],"Identifies":[211],"proof":[217],"life,":[219],"bargaining,":[220],"support.":[222],"Examines":[224],"used":[227],"Shows":[235],"strategic":[236],"shifts":[237],"across":[238],"phases,":[240],"adapting":[241],"evolving":[243],"dynamics.":[244],"Highlights":[246],"similarities":[247],"ransomware,":[249],"hostage,":[250],"business":[252],"Provides":[255],"actionable":[256],"professionals":[260],"enhance":[262],"resilience.":[263]},"counts_by_year":[],"updated_date":"2026-03-14T06:41:57.775601","created_date":"2026-02-27T00:00:00"}