---
title: Ransomware gangs source specialist crews
description: It feels like Hollywood but it’s a sad truth that ransomware gangs are assembling specialist crews, rather like a heist movie.
---

[Byte-size Bulletins ](https://www.thefinalstep.co.uk/bytesizebulletins)

# [Ransomware gangs source specialist crews](https://www.thefinalstep.co.uk/bytesizebulletins/ransomware-gangs-source-specialist-crews)

 Written by [Simon Heath](https://www.thefinalstep.co.uk/bytesizebulletins/author/simon-heath) | Aug 16, 2021

A recent report revealing how ransomware gangs assemble their teams for attacks could be mistaken for the plot of a Hollywood heist film.

 

However, unlike your favourite summer blockbuster, the threats posed here are* far* from fictional. 

 

Victoria Kivilevich, a Threat Intelligence Analyst at KELA, has identified that criminals are partnering or outsourcing for specialist skills to maximise profits. The report draws on research into the [Dark Web](https://www.thefinalstep.co.uk/cyber-security-solutions/dark-web-monitoring) where criminals advertise their services and look for skills they lack.

 

The primary roles identified when collaborating on an attack are described as: code, spread, extract and monetise.

 

We can think of these as:

- Build or buy the software to conduct attacks, including gaining initial access.
- Develop that initial access, remain undetected and spread as widely as possible with as high a permission level as possible.
- Get control of the data, examine it for its potential and extract it without being detected.
- Maximise profit by threatening consequences and negotiating the ransom.

Certain skills are more highly prized and rewarded. A relatively new, but increasingly demanded skill is negotiation. The KELA report theorises as to why this is the case:

- Insurance companies have provided professional negotiators to victims, so the ransomware crews are upping their own game in response.
- Ransomware gangs may not include native English speakers and are now advertising for “conversational English” as negotiations are becoming more nuanced and involving more factors.

You can find [the report here](https://ke-la.com/ransomware-gangs-are-starting-to-look-like-oceans-11/).

Photo by [De'Andre Bush](https://unsplash.com/@deandre?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) on [Unsplash](https://unsplash.com/s/photos/hollywood?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)

[View full post](https://www.thefinalstep.co.uk/bytesizebulletins/ransomware-gangs-source-specialist-crews)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Simon Heath"
  },
  "dateModified" : "2024-12-05T13:01:45.511Z",
  "datePublished" : "2021-08-16T08:10:06Z",
  "headline" : "Ransomware gangs source specialist crews",
  "image" : {
    "@type" : "ImageObject",
    "height" : 628,
    "url" : "https://info.thefinalstep.co.uk/hubfs/BSBulletins%20News/de-andre-bush-hollywood-unsplash_resized.jpg",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.thefinalstep.co.uk/bytesizebulletins/ransomware-gangs-source-specialist-crews",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Byte-size Bulletins"
  }
}
```