Chat

Negotiation chat with different groups

Akira

Avaddon

Avos

Babuk

BlackBasta

BlackMatter

Cloak

Conti

Darkside

Dragonforce

  • 058f4b92-ae99-45c7-bf35-5d2d6754b3de – 19 message(s) voir chat
  • 05f724f8-906e-4739-8177-815852cc2c3f – 29 message(s) voir chat
  • 29BBE03074FDBB8D – 10 message(s) voir chat
  • 7A313D13EB6B4E58 – 32 message(s) voir chat
  • 89716D29D2CEE36F – 23 message(s) voir chat
  • AB0404E049514B50 – 28 message(s) voir chat
  • BD004D632D87DBA0 – 25 message(s) voir chat
  • C2A3C7249797F5ED – 66 message(s) voir chat
  • C42CDF65B97D0E92 – 30 message(s) voir chat
  • C7CD31EAAF9DE9AC – 71 message(s) voir chat
  • C8479B30418B331E – 4 message(s) voir chat
  • D6DDD9B26D7D41DB – 14 message(s) voir chat
  • FDA8141B6DD392E3 – 10 message(s) voir chat
  • b8e14e1a-548f-4eec-bd6e-a590126e57c9 – 14 message(s) voir chat

Hive

Hunters International

Mallox

NoEscape

Pear

Qilin

  • 20240429 – 3 message(s) voir chat
  • 20250203 - from @RakeshKrish12 – 36 message(s) voir chat

REvil

RansomHub

Ranzy

RunSomeWares

fog

lockbit3.0

mount-locker

trinity

Victim
> [redacted]
Akira
> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
Victim
> Yes
Akira
> Wait a bit.
Akira
> List.7z // 554 KB
Akira
> These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.
Victim
> [redacted].pdf
Victim
> [redacted].docx
Victim
> [redacted].docx
Victim
> Files.zip // 54.1 KB
Akira
> Passing to my tech dept. Please wait.
Akira
> decrypted.7z // 22 KB
Akira
> files.7z // 538 KB
Akira
> So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us calculate our demand to you. We're willing to set a $350,000 price for ALL the services we offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Victim
> We are interesed in parts. Can you detail the price on every service ?
Akira
> 1) full decryption assistance - $250,000;
2) evidence of data removal - $150,000;
3) security report on vulnerabilities we found - $25,000;
4) guarantees are included to each of the above options.
Victim
> The amount requested by you is exaggerated. The amount requested by you is half of the company's profit for the whole year. If we refer to the encrypted data, it can be recovered by manually restoring the databases, something that certainly costs less than $250,000 - the cost of total decryption. We are still willing to negotiate, but with a much smaller amount. The maximum we can offer is $50,000, but we cannot pay the amount in full, but in installments, because we cannot legally remove this amount from the accounting. Our proposal is to divide this amount into 10 packages, and you decrypt packages of files for us. We pay in advance for each package.
Akira
> We will never accept your terms, so we can end this right now. You can go back and forth but we will never be lower than 230k for the full package. The first option is $140,000 and it is the bottom line. We accept payments in full, so you can transfer funds to your broker in parts.
Victim
> How will we pay ?
Victim
> what is the bank account ?
Akira
> We accept payments in bitcoins. Once we agree on the price, I'll provide you our wallet ID.
Victim
> The board has agreed to a 100.000 euro payment
Victim
> This is for full decryption
Victim
> We can do it in one payment
Akira
> ok. We are ready to close the deal at $120,000. I am pretty sure you can add a bit to your current offer and make a transaction that will satisfy both parties. Here is our BTC wallet [redacted] Please let me know how soon can we expect the transfer.
Akira
> Hello. Are you going to finish the deal with us?
Victim
> Hello! We are processing the request with the Financial Department and Legal
Akira
> How long should we wait?
Victim
> We have made a test transaction. The board is reluctant to this type of payment. Now we wait for confirmation of the payment.
Akira
> 0.00430313 received. You can proceed with the full amount.
Akira
> What's your progress?
Victim
> Economic department issues
Akira
> How soon can w eexpect the rest?
Akira
> I am waiting for an update from you today.
Victim
> It seems the board is doesn't trust to pay the money
Akira
> Can you please explain? Are we going to have a deal? You've already sent us the test payment.
Victim
> The board came to the conclusion that we have no warranty that we will get our data back. The risk of not getting anything vs. the amount that we have to pay.
Akira
> We've proven that we can decrypt the files and after payment we can give you back the files we took from your network. Our initial demand has been decreased significantly and now you are saying that there is a risk. Did I understand you right that this is your final decision and there will be no deal with you?
Victim
> I'm sorry. It is not my decision
Akira
> OK Thanks for the information. We will announce this incident on our blog and your data will be uploaded there as well.

Auteur/autrice

sdgadmin@tux.ovh