Ransomware gang posts ransom “negotiator” job ad

Among the skills required is the ability to make a CEO “paranoid” to the point of paying.

At the end of April of 2024, the cyber threat analyst 3xp0rt presented a job ad posted on a cybercrime forum by the ransomware gang HelloGookie (formerly HelloKitty). The cybercriminal group explains looking to hire someone capable of negotiating with CEOs who are unwilling to pay the ransom.

The offer outlines the required skills for the position. The “candidate” must be able to use Google and/or LinkedIn to identify “the right person,” and get in touch with them directly, in English. The ad then requires the ability to push the person, through careful and crafted wording, “to paranoia”, in order to make them pay.

For this specific set of skills, HelloGookie is offering a yearly wage of up to 50,000 dollars (46,700 euros), plus bonuses when the victims agree to pay up. “We are looking forward to having you on our happy team,” concludes the cybercriminal group.

The “negotiators” play a crucial part in the ransomware economy. They retrieve personal information on their victims, and can thus play on their flaws and fears to make them crack. “REvil, DarkSide, Conti, etc., they’ve all done it. They use social engineering to put pressure on CEOs,” concludes 3xp0rt.