The person who answers a ransomware victim may have a different job from the person who obtained access. The edited catalogue assigns talks to affiliates in The Gentlemen’s offer and allows affiliate or staff negotiation in Gunra’s. KittyKatKrew’s 1 June offer prices a hosted portal separately: $100 setup plus $30 monthly, with the dollar denomination unstated. The crew advertises a 10% share of any payout.
These offers are not isolated. Brandefense Blackhole found 12 retained recruitment items between January and October 2026: nine programme ads, two partner notices and one insider-access signature. The two partner notices go further: one sets a silence deadline, the other announces legal and call-centre pressure.
This piece is part of the Brandefense Cybercrime Report 2026. The wider picture, 9,203 de-duplicated leak-site claims from 177 groups, is in the ransomware chapter. Here we look only at the talks: who sells them, what they cost, who answers the victim and which rules the crews set in advance.
- RolesCrew staff, affiliate-run talks and hosted negotiation portalsSource: Brandefense Blackhole, ads first seen 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised, no currency named
- $100Setup price of a hosted negotiation portal, plus $30 a monthSource: Brandefense Blackhole, ads first seen 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised, no currency named
- $5,000One-time price of a white-label platform with victim chatSource: Brandefense Blackhole, ads first seen 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised, no currency named
- 2 weeksA notice threatens an undated listing when a target has not opened the negotiation chat within two weeks; the retained description does not establish when that clock starts.Source: Brandefense Blackhole, ads first seen 1 January to 27 October 2026, found in a keyword-led hunt; amounts as advertised, no currency named
A Portal and a Negotiator Are Different Products
A portal supplies a place to exchange messages. It does not establish who has authority to bargain. The catalogued Gunra panel permits affiliate or staff negotiation; The Gentlemen description assigns negotiation to the affiliate and forwards victim contact. The CRPX0 platform offer instead packages the technical infrastructure.
| Dated catalogue description | Advertised responsibility | What it does not establish |
|---|---|---|
| Gunra · 11 April | Affiliate or Gunra staff negotiate | Which person conducted any real negotiation |
| The Gentlemen · 15 May | Affiliate conducts talks; victim contact forwarded | Authority or delivery in an actual case |
| KittyKatKrew · 1 June | Optional hosted negotiation portal | Staffing of the chat |
| CRPX0 platform · 23 July | White-label platform with victim portal | The platform buyer’s later conduct |
The role distinction matters during response. A message from the portal is a communication channel, not proof that its sender controls every copy of stolen data or every party involved.
The Price List for Talks
Negotiation is not only a feature. At least two sellers priced it. KittyKatKrew announced on 1 June that it was moving to an affiliate model.
Partners pay $200 once for a pre-compiled stub. For another $100 they can add a negotiation portal with dedicated hosting for their group, billed at $30 a month. The crew keeps 10% of any payout, and the affiliate keeps 90%.
Negotiation is billed apart from the malware. A year of the portal costs $460 ($100 plus 12 times $30), which is more than twice the $200 stub. The catalogue records a 10% operator share; this is an advertised term, not a measured payment.
CRPX0 went the other way. On 23 July it offered the whole operation under the buyer’s own brand. The kit had a command panel and affiliate management.
It also had a branded leak site with countdown timers and a victim negotiation portal with per-victim chat. The price was $5,000 once, with no revenue share and support as advertised.
The platform offer sells infrastructure under the buyer’s brand. The no-revenue-share clause belongs to that one-time platform offer. It is a different contract from CRPX0’s earlier affiliate programme, which the reconciled terms catalogue describes as a 70% commission.
CRPX0 posted 49 distinct claims in July and August and none after; we cannot tell whether that is a sale, an exit or a rename.
| Seller | First seen | What the ad offers for the talks | Price or cut, as stated |
|---|---|---|---|
| KittyKatKrew | 1 Jun | Hosted negotiation portal with dedicated hosting, an add-on to a $200 stub | $100 setup, $30 a month (crew takes 10% of any payout) |
| CRPX0 platform | 23 Jul | White-label RaaS with victim chat portal and branded leak site | $5,000 once, buyer keeps all profit |
| CRPX0 programme | 1 Jul | Dedicated negotiation team handles victims | 70% commission to the partner on every successful payment |
| Gunra | 11 Apr | Crew staff can run the talks; affiliate or staff may negotiate | Operator fee 15%, lower by target |
| The Gentlemen | 15 May | Affiliate controls the talks; crew forwards victim contact | 90% to the affiliate |
| Nova 2.0 | 22 Apr | Panel, blog and build service in the catalogue | Conditional 75–95% share; threshold currency unstated |
| KRYBIT | 17 May | Catalogue describes lawyers and journalists as pressure resources | Split not shown |
Four tool or kit sale listings, such as the CRPX0 platform, also mention negotiation features. For the splits themselves, see the ransomware chapter.
Who Answers the Victim
The selected descriptions distinguish the person conducting the chat, the provider of a hosted portal and the supplier of pressure services. KRYBIT’s reference to lawyers and journalists is a different advertised responsibility from either staffing the chat or hosting it. These categories are not a common numerical support measure.
The edited 15 May description gives The Gentlemen’s affiliate 90% and responsibility for the negotiations, with victim contact forwarded to that affiliate. This is the relevant allocation of work; the catalogue does not establish the mechanism used to forward messages.
Here the crew asks the affiliate to carry the talks, while its own infrastructure is a leak site and a relay.
The edited Gunra description allows either the affiliate or staff to negotiate. Its terms record a 15% operator fee, which may be lower depending on the target. The availability of staff means the intruder and the person conducting talks need not be the same party.
Here crew staff sit in the chat, so the person typing may never have touched the victim’s network. That is our reading of the ad, not a claim from the crew.
Two things follow for a victim. The voice in the chat may not belong to the intruder, so a promise from one party does not bind another. And the model can change from one crew to the next, so a negotiator who knows one group’s habits cannot assume them for another.
The Pressure Rules Crews Publish
Some crews do not wait for the victim to speak. The Mimic partner programme posted a notice to partners, first seen on a Russian-language forum on 1 February, that sets a clock. A target that has not entered the negotiation chat within two weeks gets a public leak-site entry with no date. The stated aim is to pull the company into talks.
This makes the leak site a starting lever, not only the last step. The clock belongs to the crew, and the crew announced it to its partners in advance.
The 14 January catalogue description records a Russian-speaking partner requirement, call and mailing services, and contact look-up per target. It also describes a 17 January announcement of legal-violation paperwork against victims who go silent or refuse payment. We retain that as a catalogue account of a threat, not evidence that any filing or pressure campaign occurred.
Pressure is part of the product, in the seller’s own words. We have no evidence that any of these threats was carried out. The post is a sales claim, and it tells partners what they may promise. Both this thread and the Mimic notice carry dates that are when Blackhole first saw them, not when they were written.
The 17 May KRYBIT catalogue description says lawyers and journalists can be used to influence negotiations. This describes a claimed pressure resource; it is not proof of actual professional participation or influence.
The edited descriptions offer paperwork, calls and mailings as pressure resources. They do not establish that these services were delivered.
After the Talks
A published pressure rule and the later circulation of a file answer different questions. Here the question is who runs the chat and what authority that person has. Our investigation of data after alleged failed talks follows unpriced publication, reposting and sale offers, without treating those routes as one victim journey.
What Victims and Negotiators Can Do With This
The ads give a defender something rare: the rules of the other side, in writing. Use them to plan before the note arrives. The CISA StopRansomware Guide covers the response steps. These additions come from the ads in this piece.
- Treat a published deadline as policySilence can trigger a listing by rule, so decide on purpose who answers and by when.
- Do not assume the crew itself is talkingA portal link in a note can mean a service provider or an affiliate is on the other side. Keep your own channel and counsel.
- Expect pressure outside the portalCalls, mailings and legal paperwork are advertised as pressure services. Line up legal and communications first.
- Log who says whatDifferent voices may speak for the same crew. Note which promise came from which voice.
- Verify the claim before you decideA claim is not a confirmed breach. Check posted samples against your own logs.
- Keep every page and messageSave portal pages, timestamps and chat logs for your incident team and for investigators.
Brandefense follows these claims through ransomware intelligence, which can help identify listings naming your organization. The glossary entry on ransomware-as-a-service explains the model behind the ads.
Evidence and Scope
This article uses the edited 60-item ransomware catalogue and the collected relay series for 1 January–27 October 2026. Catalogue dates are first-seen dates.
The selection is not a market census; programme descriptions, advertised terms and claims are different evidence units. The catalogue is an attributed account, not a fresh authentication of every original. October is partial and 22–28 July is sampled.
A claim is one canonical group–victim pair. The 9,203-claim series excludes 190 0APT claims and removes 171 spelling-variant duplicates. A repeated relay post is not independent confirmation. Asking terms do not establish payments, delivery or tested effectiveness.
AI-Assisted Preparation
Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.
Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone.
Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed.
Brandefense analysts reviewed and approved the findings.
