Ransomware group uses AI chatbot to intensify pressure on victims

INFOSECURITY MAGAZINE

One innovation the GLOBAL group has introduced is the use of an AI chatbot to kick off the negotiation process.

The ransomware group offers a dual-portal model, directing victims to a Tor-based data leak site and a separate negotiation panel – a structure reminiscent of LockBit’s compartmentalized backend, suggesting that GLOBAL employs a double-extortion approach.

Once on the negotiation panel, the victim is greeted by an AI-powered chatbot designed to automate communication and apply psychological pressure.

The panel is designed for non-technical users, featuring prompts to upload a sample encrypted file for free decryption verification. All correspondence takes place over a secure channel, with a timer displayed to reinforce the urgency.

Chat transcripts reviewed by analysts show demands reaching seven-figure sums, such as BTC9.5 ($1m at the time the negotiation process occurred), with escalating threats of data publication.

Read more | INFOSECURITY MAGAZINE

---