Chat

Negotiation chat with different groups

Akira

Avaddon

Avos

Babuk

BlackBasta

BlackMatter

Cloak

Conti

Darkside

Dragonforce

  • 058f4b92-ae99-45c7-bf35-5d2d6754b3de – 19 message(s) voir chat
  • 05f724f8-906e-4739-8177-815852cc2c3f – 29 message(s) voir chat
  • 29BBE03074FDBB8D – 10 message(s) voir chat
  • 7A313D13EB6B4E58 – 32 message(s) voir chat
  • 89716D29D2CEE36F – 23 message(s) voir chat
  • AB0404E049514B50 – 28 message(s) voir chat
  • BD004D632D87DBA0 – 25 message(s) voir chat
  • C2A3C7249797F5ED – 66 message(s) voir chat
  • C42CDF65B97D0E92 – 30 message(s) voir chat
  • C7CD31EAAF9DE9AC – 71 message(s) voir chat
  • C8479B30418B331E – 4 message(s) voir chat
  • D6DDD9B26D7D41DB – 14 message(s) voir chat
  • FDA8141B6DD392E3 – 10 message(s) voir chat
  • b8e14e1a-548f-4eec-bd6e-a590126e57c9 – 14 message(s) voir chat

Hive

Hunters International

Mallox

NoEscape

Pear

Qilin

  • 20240429 – 3 message(s) voir chat
  • 20250203 - from @RakeshKrish12 – 36 message(s) voir chat

REvil

RansomHub

Ranzy

RunSomeWares

fog

lockbit3.0

mount-locker

trinity

Victim 17:29
Our managers just told me they are meeting about this situation and how to pay you. They are asking if you can give us a list of the data you took. Can you please give a list of the files you downloaded?
Black Basta 17:32
Sure, wait please.
Black Basta 17:39
Download file: [redacted].zip
Black Basta 17:41
This is the full list of your taken data. You can choose any 3 file names from list and I will send them to you, like a proof. But these files must not contain the important information.
Victim 14:49
Thank you very much!
Black Basta 14:52
We wait your files.
Victim 12:38
Here are the three files:
Victim 12:38
Company/_SALES AND MARKETING/1_Client Services/1_Account Management/[redacted]/2020/[redacted] Data Transfer Agreement [redacted] - signed.pdf

HR/Employee Files/Current Employees/[redacted]/[redacted] SIGNED.pdf

Company/_SALES AND MARKETING/1_Client Services/Contracts/[redacted] Contract/[redacted] partner agreement.pdf
Black Basta 05:10
OK, wait please.
Black Basta 05:15
Download file: [redacted].zip
Black Basta 05:15
These are your requested files.
Victim 10:48
Thank you. I will give these files to my manager.
Black Basta 10:49
We'll be in touch.
Victim 23:19
They asked me today if you will give us some kind of proof when you delete the files? Also, they asked what is the method to pay you? Is it wire transfer? They will have a meeting tomorrow with the executives, so they are asking these questions. Thank you.
Black Basta 03:24
After deleting files, we will send you a full deletion log. As for the payment, - we accept the payment in cryptocurrency bitcoin.
Victim 16:42
Okay, thank you. They have another question about the payment. When you said $700,000, did you mean Canadian dollars? They just want to be sure since our company in in Canada, not in the USA.
Black Basta 16:45
No, we mean US Dollars.
Victim 04:57
Okay. Our executives have analyzed everything with the information you provided. They told me to tell you that they can agree to pay $250,000 US dollars within 24 hours if you can accept that amount.
Black Basta 05:44
No, we don't agree. Our price is $700,000 ,but we can give you 20% discount if you pay during 48 hours. If you don't pay for this time, then the price will become initial.
Victim 00:34
Hello. Our company leadership has been working to meet your demand. We are now able to pay you $500,000 US dollars, but we have to pay a lot of money for the conversion from Canadian dollars to US dollars. We also checked on how to send the payment and we have to pay a large fee for sending the bitcoin.
Victim 00:36
Can you please accept the payment as $500,000 US dollars? That way, we still have some money to pay the fees for conversion and for the bitcoin? Thank you.
Victim 01:52
Also, if you accept this, please send us the wallet address for the bitcoin payment. We already have the company to send the payment but they asked us for the bitcoin address. Thank you.
Black Basta 06:48
OK, we agree. After payment:
1. You receive decryptors.
2. Your page will be totally deleted from the blog.
3. ALL your data will be deleted and you will receive the full deletion log.
4. You will get penetration report and recommendations how to avoid such the situations in the future.
5. You receive the guarantee that BB or anyone of our team will not NEVER attack you again.
Our BTC wallet: [redacted]
Victim 11:10
Okay, thank you! We will work to send the payment quickly today.
Black Basta 11:11
We'll be in touch.
Victim 22:53
Hello. We have everything ready to send the payment to you now, but our executives would like to send a small payment first so you can verify that you received it. Then, we can send the rest. They are just nervous about using bitcoin for the first time.
Victim 22:54
is it okay to send you the small payment first and then send the rest right after you tell us you received it?
Victim 23:16
also, please verify the wallet address again as: [redacted]
Black Basta 00:45
Just a minute
Black Basta 00:46
We confirm this address [redacted]
Black Basta 00:56
We are waiting your test payment
Victim 01:10
thank you. will we be able to send the second payment to the same address? I mean both payments will go to the same wallet?
Black Basta 01:11
Yes
Victim 01:12
thanks.
Victim 01:19
The company doing the payment for us just told me they are sending 0.43 BTC now as the test payment.
Victim 01:24
Please confirm when you receive it.
Black Basta 01:34
Confirm 0.43000000 BTC
Victim 01:38
thank you.
Black Basta 03:06
Payment received.
Your blog was deleted. Now your data is wiping.
Black Basta 03:23
Download file: [redacted].rar
Black Basta 03:24
This is log of deletion all your taken data.
Black Basta 03:24
Security report and recommendation:
Your network has been compromised by mailing of messages to the emails with malicious attachments.
One of the users launched malware.
To avoid this in the future, give you recommendations of network protection:
1. Use sandbox to analyze the contents of letters and their attachments.
2. Use the password security policies
3. Make protection from attack like a Pass-the-Hash and Pass-the-ticket attack
4. Update all OS and software to the latest versions, especially Microsoft Defender Antivirus.
5. Implement the hardware firewalls with filtering policies, modern DLP and IDS, SIEM systems.
6. Block kerberoasting attacks
7. Conduct full penetrations tests and audit
8. Use and update Anti-virus/anti-malware and malicious traffic detection software
9. Configure group policies, disable the default administrators accounts, create new accounts.
10. Backups. You must have offline backups, does not have access to the network.
Victim 03:33
thank you for the fast response. when can we get the decryptor?
Black Basta 03:33
Very soon.
Black Basta 03:34
Now is preparing decryption tools.
Victim 03:34
thank you
Black Basta 06:53
Download file: [redacted].exe
Black Basta 06:54
How to decrypt windows?
1. Drop executable to any folder.
2. Start new terminal session with administrator rights. (run cmd.exe or powershell.exe with admin rights)
3.1. In cmd.exe type full path to the executable file and press Enter.
3.2. In powershell.exe type: "& c:\full\path\to\executable.exe" without quotes and press Enter.



OR

1. Drop file.
2. Click right mouse button on the file and press run as admin.


(!) IMPORTANT
1. Yoy can decrypt only 1 folder (test decrypt for example)
decrypt.exe -forcepath c:\users\1\Desktop\folder
2. DO NOT CLOSE decryptor yourself

OR

1. Drop file.
2. Click right mouse button on the file and press run as admin.


(!!!!!!!) IMPORTANT
1. You can decrypt only 1 folder (test decrypt for example)
decrypt.exe -forcepath c:\users\1\Desktop\folder
2. DO NOT CLOSE decryptor yourself.
Victim 12:20
thank you
Victim 16:39
Thank you. the decryption is working on our test files. Is it possible for you to tell us which employee opened the attachment file in the email? either the employee name or the name of the computer? That would help us very much. Thank you again.

Auteur/autrice

sdgadmin@tux.ovh