OkoIntelligence
Menu
ServicesPartnersResearchCase studiesEthicsContact an analyst

Services / #7 Respond

Incident response support

During a ransomware or extortion incident, we establish who the attackers are, whether they have honored past deals, and whether they took what they claim.

Contact an analystSee an example

What you get

Benefits

01

Threat actor profile

A prompt profile of the group: how it operates, whether it honors deals, and how it treated past victims who paid.

02

Leak verification

Extortion groups often exaggerate. We check what has actually been posted, without downloading stolen data.

03

Facts for decisions

Counsel, insurers and leadership get verified information for negotiation and notification decisions.

04

Coordinated with your response team

We work alongside your IR firm and breach coach and keep everyone informed.

What’s included

What We Do

  • Ransomware and extortion actor profiles
  • Leak verification

How it works

How It Runs

  1. Step 1

    Engage

    Usually through your breach coach or IR firm, often the same day.

  2. Step 2

    Profile

    We pull together what’s known about the group and its track record.

  3. Step 3

    Verify

    We watch the leak site and describe what’s posted, without acquiring it.

  4. Step 4

    Update

    Short written updates as things move, until the incident closes.

Case study

Checking a ransomware group's leak claims

A ransomware group claimed to have stolen patient records and set a deadline. The breach coach needed to know who they were dealing with and whether the claim was true.

Example engagement. The client is fictional and details are illustrative, to show how this work typically goes.

Client
Breach coach handling an incident for a dental group
Engagement
Two weeks, hourly

Same day

first actor profile delivered

Smaller

leak than claimed, confirmed by posted samples

Daily

leak-site updates until the incident closed

The situation

A dental group was hit by ransomware. The attackers claimed to have patient records and posted a countdown on their leak site. The breach coach, the IR firm and the insurer needed facts quickly to decide on notifications and negotiations.

What we did

The breach coach brought us in the same day. We put together a profile of the group: how long it had been active, how it usually negotiates, and whether it had kept its word with past victims. We then watched the leak site and described everything posted about the dental group, without downloading any stolen files.

What we found

The group was a rebrand of an older operation with a mixed record of deleting data after payment. Its sample files showed it had taken appointment schedules and some billing records. They didn’t show the full patient records it claimed, though the samples alone couldn’t rule that out.

What changed

Counsel used the profile and leak verification to scope notifications more accurately, and the insurer used them in its decisions about negotiation. We sent daily updates until the listing came down and the incident closed.

Related services

Discuss this service with an analyst

Tell us about your situation. We’ll confirm whether this service fits and agree on scope and price before any work starts.

Contact an analyst