  In this paper, we consider how the development of targeted ransomware has
affected the dynamics of ransomware negotiations to better understand how to
respond to ransomware attacks. We construct a model of ransomware negotiations
as an asymmetric non-cooperative two-player game. In particular, our model
considers the investments that a malicious actor must make in order to conduct
a successful targeted ransomware attack. We demonstrate how imperfect
information is a crucial feature for replicating observed real-world behaviour.
Furthermore, we present optimal strategies for both the malicious actor and the
target, and demonstrate how imperfect information results in a non-trivial
optimal strategy for the malicious actor.
