威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

威胁者：Your attempts to waste our time could force our exit from negotiations and cause data publication.

受害者：we identified our systems to be encrypted and we have limited back ups. Let us know if you can help with recovery.

威胁者：We will let you know soon.

威胁者：Hello! First of all send us 2-3 encrypted files, so we can prove that we can restore them. Secondly we have downloaded 400 gb of your sensaitve data. In the attachment we sent you the file-lists of data we have downloaded from your network. You can request any 2-3 files from that list as proof that we have the files. For the service of decryption and secure deletion of downloaded files your company must pay 900000 usd in BTC. File list: https://temp.sh/[redacted]/all.txt

受害者：knock knock !

威胁者：Don't you see our previous message? We've sent the list and outlined the deal terms.

受害者：We received your ransom note. What is next?

威胁者：Congratulations, you have passed a surprise information security audit and become a victim of ransomware. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

威胁者：[redacted] list // 980 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：We're looking through your files to calculate a fair demand to you. I will let you know the sum shortly. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

威胁者：[redacted]_list2.zip // 2.09 MB

威胁者：Here is additional data we took from some of your trusts.

受害者：How much data did you take from us in GB's? Are these two lists everything you took?

威胁者：About 200 GB in full.

威胁者：Yes, these two list are everything we took.

受害者：Can we use a separate chat for the conversation going forward?

威胁者：Yes, I will send a new chat ID shortly.

威胁者：https://privnote.com/[redacted]

受害者：I'm here what do you want?

受害者：Im here

受害者：hey

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

受害者：Yes I can negotiate but dont have to the ability to approve $$ amounts

受害者：And I will keep in touch

威胁者：We will provide all the deal terms during this day. Please be in touch.

威胁者：list.zip // 2.84 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price. If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.

受害者：I have downloaded the file list and will review it with the team

威胁者：Meanwhile, we will come up with a fair demand to you.

威胁者：So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $165,000 price for ALL the services we offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：Thanks for the detail. I'm working on getting those files 2-3 files to decrypt and should have them tomorrow, but I have to travel in the morning but should have them by the time I land Talk to you tomorrw

威胁者：We're standing by, thanks.

受害者：[redacted].txt.akira // 26.8 KB

受害者：[redacted].xml.akira // 866 Bytes

受害者：Sorry for the delay, here are two files, We are working on identifying file from the list to provide us.

威胁者：We will upload the decrypted copies soon.

威胁者：[redacted].txt // 26.3 KB

威胁者：[redacted].xml // 324 Bytes

受害者：Got them thanks, I'll have the files we want soon

威胁者：Standing by.

威胁者：How long should we wait?

受害者：Capture4.JPG // 33.5 KB

受害者：Capture5.JPG // 43 KB

受害者：Capture6.JPG // 32.3 KB

受害者：Here are three files we would like for you to provide.

威胁者：We will upload the files shortly.

威胁者：[redacted] Corporation.pdf // 389 KB

威胁者：[redacted].pdf // 107 KB

威胁者：[redacted].pdf // 235 KB

威胁者：Have you reviewed the files?

受害者：I'm downloading them now TY for getting these so quick. Let me get these back to the team.

威胁者：Let us know when you have reviewed the files and are ready to proceed.

受害者：I forgot to mention that today and tomorrow are a major holiday in the US and most of leadership is gone till Wednesday. Some of us like me still have to work but can we pick this up wednesday?

威胁者：We are well aware of the holiday. Thank you. Yes, you can. But time's ticking.

威胁者：Hello. We're going to publish your data this week. Thank you.

威胁者：You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

受害者：I see that you did post us on the site, how much time do we have before you publish?

受害者：The reason we ask is your demand is too high for us pay

威胁者：The publishing will take 1-2 days. Have you managed to gather something to offer us?

受害者：Are you saying your willing to negotiate a lower price then?

威胁者：It depends on the amount you can offer us at the moment.

受害者：We think we can muster about $23K to $25k in short time.

威胁者：No way. We won't accept anything lower than $100k.

受害者：Hmmm that still to rich for us, let me see what we can counter offer Brb

威胁者：We are waiting.

受害者：Since you posted us on your shame site, you have already caused damage to us and we have ambulance chasers and client calling so we cant put the genie back in the bottle. I counter offer with $38K.

威胁者：You know our price. What you are offering is unacceptable. If you have no intentions to save your data, we will upload it to our blog.

受害者：We must have missed a step, We have no need for your decryptor. But we dont want our data posted either if we can afford it but not at your current demand

威胁者：I see. We can delete your data for $80,000. Not less. After we are paid, we will provide you with the deletion log file.

受害者：We do appreciate your willingness to work with us, we can offer $59K USD. If you agree we can make payment promptly and if you can provide a BTC wallet we can work on getting money moved to pay that wallet

威胁者：I've discussed with my management. We can accept $75,000. This is final. Do you need our btc wallet?

受害者：OK let me confirm with the team brb

受害者：Please provide the BTC wallet

威胁者：We will provide you soon.

威胁者：Here it is: [redacted]

威胁者：How soon can you make a transfer?

受害者：I have to clear the wallet id to make sure I can pay it so I've been told. Then I can give you a better answer, but were trying for early next week payment

威胁者：Ok

受害者：ok we are getting closer Here is the agreement

受害者：We will pay $75,000 to BTC Wallet [redacted] in exchange for taking us off your website, not publish or share our data with anyone, remove any social media reference about us, delete our data and show us proof you deleted the data, identify how you got into our network and never attack us again

受害者：You agree?

威胁者：We do confirm the terms.

受害者：Can you confirm payment was made?

受害者：Please provide us with what you agrred to and we can complete this deal

受害者：I still see us on your shame site

威胁者：Payment received.

威胁者：The post deleted.

威胁者：We will provide you with the report and the deletion log within 24 hours.

威胁者：Initial access to your network was purchased on the dark web. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security. The deletion log is coming later.

受害者：Thanks for this I'll check in later for deletion proof

威胁者：Sure. We will upload it soon.

受害者：Hey Its been several days since we made payment, can we get this completed today?

威胁者：Hello. I think we can. I'll try to provide you with the log within a few hours.

受害者：ok ty

威胁者：log_erase.7z // 327 KB

威胁者：Here it is finally!

受害者：thanks

威胁者：You're welcome.

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

威胁者：list.txt // 3.76 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.

威胁者：You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

威胁者：Congratulations, you have passed a surprise information security audit and become a victim of ransomware. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

威胁者：list.7z // 493 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：We're looking through your files to calculate a fair demand to you. I will let you know the sum shortly. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

威胁者：In case we don't have a response form you, we will have to post your data in our blog.

受害者：Hello, we're reviewing the list you sent us now.

威胁者：Ok. We are waiting for the files request tomorrow.

威胁者：Hello. Have you review the list?

受害者：Hello, we are still reviewing the list at this time but will have those files over to you as soon as we finish. Is this list everything? We want to make sure prior to sending over our requests.

威胁者：Yes, this is everything.

威胁者：We're willing to set a $350,000 price for ALL the services we offer.

受害者：You advised we could request some files from that list you sent. We would like to request the below: [redacted].xlsx [redacted]-2023.xlsx [redacted]23.docx

威胁者：[redacted]2023.xlsx // 336 KB

威胁者：[redacted].xlsx // 15.6 KB

威胁者：[redacted]23.docx // 1.84 MB

威胁者：Please review the files.

受害者：Okay thank you we are reviewing these. We still need some time to review the entire listing itself and we are a bit worried about your price. I dont think we can afford the 350,000 and theres no guarantee you wont just take the money and run off. How are we supposed to trust this process?

威胁者：If we receive the payment within next 48 hours, we will provide you with a 20% discount. After payment you will receive a deletion log which means the raid drives that contained the only copy of your data are fully formatted and erased. There is no need to deceive you since we value our reputation and you will find no case where we didn't honor an agreement. If we fail to agree, we will not only publish your data but also notify all of your clients, partners, employees and so on. In some cases they will be guided on how to file a claim properly. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again.

受害者：We understand and thank you for the information. We're already in the process of trying to find out exactly how much we can offer you, but it won't be close to the price you gave us. We'll update as soon as we can. I know you said you can unlock our files can we send some over to you? We have a few file types we are concerned with.

威胁者：To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. Our tool works on every system/file format. As for your upcoming proposal, we haven't talked about any discounts yet, so you're wrong since you have to get as close as possible to our initial demand to get this over. Thank you.

受害者：A lot of our files are larger than 10mb, how do we know the decryption will work on those larger files? Also you are mentioning a discount, is this something you can do for us? We will work on getting the files sent over to you but are concerned we cannot sent anything less than 10mb.

威胁者：You can provide us with one of larger than 10MB. No one is going to deceive you.

受害者：Ok thank you, we are working on it. We will upload this once we have it, I just need to discuss with the others which ones we can send.

威胁者：Please speed things up on your part. No one is interested in dragging this out.

受害者：[redacted].dwg // 10.4 MB

受害者：[redacted].pdf // 2.39 MB

威胁者：Please wait for them decrypted.

威胁者：Please send us the correct files. We do not see any signs of our tool.

受害者：These came from the machines you locked and you said this tool was going to work. This is a little concerning, but let me have our IT grab some more files to send you.

威胁者：My tech dept has checked those files and they're not encrypted, so please send us correct files asap.

受害者：Please try what I'm attaching now to the chat

受害者：EncryptedSample[redacted].zip // 9.18 MB

威胁者：We will try.

受害者：Just checking out what's going on? Waiting your response.

威胁者：Please wait.

受害者：Hello? Are you still there? We are awaiting the files.

威胁者：Hello. We're here. I've asked my tech dept about this.

威胁者：Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

威胁者：list.txt // 297 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price. If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.

威胁者：Your data will be posted soon.

威胁者：Hello

威胁者：So, you've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

威胁者：list.7z // 1.11 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：We're looking through your files to calculate a fair demand to you. I will let you know the sum shortly. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

威胁者：So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $190,000 price for ALL the services we offer.

威胁者：If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.

威胁者：12 hours.

威胁者：You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

威胁者：list.txt.7z // 3.97 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：Please let us know whether you are interested in keeping the incident confidential. Your silence will be evaluated as a negative response.

威胁者：You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

受害者：We found your note on our computers. What do we do next?

威胁者：Hello. Can you see messages above?

受害者：Yes. We have downloaded the list and are reviewing it now. If we are going to come to an agreement, please remove our name from your website.

威胁者：The post will be taken down after payment.

受害者：Please send back the following files: D:\\[redacted].com\\unpacked\\T_Drive\\Citrix\\Applications\\CommuniCap\\[redacted]\\WordDocs\\[redacted]letter.doc D:\\[redacted].com\\unpacked\\T_Drive\\clients\\[redacted]\\Client\\Archive\\[redacted].xls D:\\[redacted].com\\unpacked\\T_Drive\\Images\\[redacted]\\Client\\[redacted].pdf

威胁者：[redacted].pdf // 1.66 MB

威胁者：[redacted]letter.doc // 21.4 KB

威胁者：[redacted].xls // 26.4 KB

威胁者：Here are the files. Do you want to give us some files for a test decryption or we can move to payment details?

威胁者：Hello. Let us know if you are interested in this deal. If you don't answer us today, we will have to move to your data uploading to our blog.

受害者：We are working on getting the sample files now. We want to resolve this with you and keep everything confidential, but we don't know how this works. How much to resolve this?

威胁者：I will let you know shortly.

威胁者：So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $250,000 price for ALL the services we offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

威胁者：So, where the files?

威胁者：Hello. We will upload your data to our blog if we don't hear back from you by Monday.

受害者：Thank you for your patience while we tried to get files to send. Can you decrypt these?

受害者：akira files.zip // 16.1 KB

威胁者：We will upload them later.

威胁者：[redacted].msc // 65.7 KB

威胁者：[redacted].ps1 // 601 Bytes

威胁者：[redacted].ps1 // 915 Bytes

威胁者：[redacted].bat // 49 Bytes

威胁者：The files are decrypted. We need to move to payment details.

受害者：Thank you for the files. We are reviewing our decryption needs and will reply soon.

威胁者：We are waiting for your reply today.

威胁者：Guys, your 600GB of data will be published soon, in case we don't have a reply from you within 12 hours.

受害者：Providing you an update that we are still here and working to get you an answer. Please stand by.

威胁者：We hope so. We won't wait two more days.

威胁者：So what's your decision? We're almost done with uploading.

受害者：Leadership has met, and we would like to explore negotiations and coming to an agreement on an amount. We are a small, private business and $250,000 is not a feasible amount for us to pay. We have very little capital, and we operate on loaned funds. Can you please bring your amount down somewhere closer to 5 digits? Our leadership is willing to pay.

威胁者：Please stop trying to fool us. Your business able to pays the sum we ask. Show us an offer more than 5 digits and we will be able to settle this. We can move towards you and come down to $200,000.

受害者：We appreciate your willingness to negotiate, and we want to be clear that we are not trying to fool you. Any and all funds in our accounts have been borrowewd and is already expensed, meaning it does not belong to us. We would like to offer $90.000 based on what we believe we are able to pull together. We know this is lower than you expect, and please know we are truly doing our best to survive here. If we can pay this relatively quickly, would you accept this amount?

威胁者：We need 6 figure proposal from you to finalize the deal. We're willing to accept 170,000 for the data we hold.

受害者：Thank you again for your continued willingness to work with us and understanding of our situation. 6-figures is difficult for us for the reasons we mentioned before. Let us see what we can do and we will provide you an update tomorrow or Tuesday. Can you confirm again what we receive if we pay you?

威胁者：Once we agree on a price and receive payment, you will receive: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.

威胁者：>

威胁者：Standing by for a decent proposal on your part.

受害者：Our leadership met as a team over the weekend. They worked through all our options and were able to find $105,468. They have leveraged everything we have as a company. Please accept our offer, so that we can all move forward.

威胁者：Hello. We're willing to accept $110,000 as a final. Here is the BTC wallet ID for payment: [redacted]

受害者：Thank you for your consideration. Our leadership is discussing now.

威胁者：Any progress?

威胁者：Well, your discussions take so much time. I am preparing your files for uploading to our blog. Tomorrow your data will be available for downloading.

受害者：We agree to pay the $110,000 to wallet [redacted], but we need time to get the funds together and bitcoin purchased. We would also like assurance that we will receive the following:

受害者：• Universal decryption tool and full decryption assistance.

受害者：• Evidence that you destroyed all copies of our data.

受害者：• Detailed security report about how you compromised our systems.

受害者：• Removal of our name from your website and guarantee not to publish or sell data.

受害者：• Guarantees not to attack us in the future.

威胁者：You will surely receive everything you stated above. When can we expect the transfer?

受害者：We are heading into the weekend and need to work with our banks to get the funds. We can make the payment by early next week.

威胁者：Ok. We can wait until Monday. Update me on your steps.

威胁者：Any updates?

受害者：Thank you for reaching out. We had some issues today with getting the money released by our bank. We fully intend to follow through with payment, but may need another day.

威胁者：You have 24 hours to sort this out. Otherwise, we will be forced to close this case.

威胁者：Hello. Checking on your status.

威胁者：We have received 0.00001 BTC. Standing by for the rest.

受害者：Thank you. We are working on sending the remaining amount now.

受害者：We have sent the payment. Please confirm you have received.

威胁者：We have received the funds, thank you. Please wait for all the promised materials.

威胁者：win_unlocker_[redacted].ex_ // 478 KB

威胁者：logs_erase.rar // 6.99 MB

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

受害者：Please send us instructions on how to use the decryptor.

受害者：We have tried running it against some files and it isn't working.

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line

受害者：Please take our name off your website.

威胁者：The post has been removed.

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

威胁者：list.zip // 2.53 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：We will wait for your decision regarding our deal on Monday. If we see no interest from you, we will publish everything the list contains.

威胁者：You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

受害者：Hello

威胁者：Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

受害者：yes i do have permission

威胁者：Ok, thank you. I will get back shortly with more information.

受害者：ok, We are here waiting.

威胁者：We have to inform you that we are experiencing technical issues at the moment. All the details will be provided on Monday the latest. Our deepest apologies. Meanwhile, to prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：ok , will get those files for you. what is the amount you are asking?

威胁者：List.txt // 9.56 MB

威胁者：This is the list of files of [redacted] company. We are working on transporting files of the rest companies and will provide you with the lists for them soon. We're willing to set a $2,000,000 price for all the services we offer.

受害者：ok, thank you.

受害者：hi, when can we expect to receive the additional lists?

威胁者：In a few hours.

威胁者：[redacted]_full_listing.rar // 1.46 MB

威胁者：This is everything we hold.

威胁者：Given the fact that we hold data of two more companies, we've reconsidered the price for the full deal - $2,400,000. Let us know whether you are interested in a test decryption or files for proof. In case of quick payment we can make a discount.

受害者：pulling down the listings now. appreciate your patience.

威胁者：Let us know if you are interested in a test decryption and proof files. Waiting for your answer tomorrow.

受害者：ok, we are working on your requests. Please allow us sometime to review the file listing and send requested files.

威胁者：Please keep in mind that tight cooperation with us often leads to a more positive end of a deal.

威胁者：We are waiting for your decision today.

受害者：We are looking through all the file listings you gave us. We will get you some files soon. appreciate your patience.

威胁者：Do not forget about files for the test decryption, if you need it.

受害者：Definitely apprecaite your patience. My team is highly stressed due to the incident, and are working to get you the files as soon as possible.

威胁者：Speed things up on your part and nothing bad will happen.

受害者：ok noted, will make sure pass this information along to my boss.

威胁者：If we don't get your decision within next 24 hours, we will be forced to announce your corporate data leak on our blog.

受害者：[redacted].edi.[redacted] // 793 Bytes

受害者：[redacted].edi.[redacted] // 1.42 KB

受害者：[redacted].edi.[redacted] // 23.4 KB

受害者：[redacted].csv.[redacted] // 74.8 KB

受害者：[redacted].csv.[redacted] // 1.1 KB

受害者：Definitely appreciate your patience and working with us. We have almost completed going through the file listing and will provide you files soon. While we finish that, can you please decrypt these files.

威胁者：Yes, I've passed the files to my tech dept. Please wait.

威胁者：files.zip // 14.8 KB

威胁者：Here they are. Please check.

受害者：thanks, pulling these down for review. will provide an update when we can.

威胁者：We have to close the deal this week. Are you in time?

受害者：We are working as fast as we can. we really appreciate your patience with us during all of this. After reviewing the file listings can you provide the following files please.

受害者：Backlog detail 2021.xlsx, [redacted] Rate 10.24-10.28.22.xlsx, Keywords.xlsx, [redacted] Inspection Log 2023.xlsx, img20230508_[redacted].pdf, [redacted] Tax Codes.pdf, Interest Payment [redacted].pdf, Sales Service Agreement.docx, Annual Refiling Survey [redacted].pdf, [redacted] - Aug Insurance Exp [redacted].xls, [redacted] - Accrue Deprec for [redacted].xls, [redacted] - Clear Obsolete Inventory [redacted].xls, [redacted] - Loss on Sale & Liquidation of Assets [redacted].xls, [redacted].xls, [redacted].PDF, [redacted] Tests.xlsx, [redacted].PDF, [redacted].PDF

威胁者：Too many files but ok. We will provide shortly. Meanwhile, how's it going with fund gathering?

威胁者：[redacted].rar // 3.12 MB

威胁者：You can review the files.

受害者：When reviewing the decrypted files you sent back, we noticed that 2 of them are not what we expected to see as they came back with some empty fields. Can you please decrypt the attached files again and send it back to us so we are able to confirm the decryptability. Appreciate you working with us.

受害者：[redacted].csv.[redacted] // 74.8 KB

受害者：[redacted].csv.[redacted] // 1.1 KB

威胁者：We will check but we actually have some doubts that they are corrupted. If it is an attempt to win more time, nothing good will happen. Please wait.

威胁者：The files are ok. In 24 hours we will announce your corporate data leak on your blog. Early next week your data will be published. Thank you.

受害者：We are not stalling for time, we are wanting to make sure that the decryption process brings back the data in its entirety. The 2 files we are asking about it appears that it dropped fields off at the end of the files.

威胁者：I'll ask to double check but bear in mind that we are posting you in our blog tomorrow if there is no payment decision from you.

受害者：We had very good backups and only about 1/4 of our data is encrypted now. We have approval to pay you $800k tomorrow for decryptors, proof of data deletion, and security audit report. Leaking our name will make our ability to pay much harder. Please accept so we can put this behind us.

威胁者：We appreciate this offer but all we can do is to give you 20% discount in such circumstances.

威胁者：I have very good news. I was talking to the upper management and they are willing to accept $1,4M today for all the outlined options. On Monday we will have to return to our previous demand. Do we have a deal now?

威胁者：So, I passed your request regarding those files to the tech department. After decryption these same files were increased in size and then re-encrypted. After decryption, the files remained the same size, which means that our decryptor absolutely works correctly. It also means that you tried to play unfairly and gain more time. We also doubt your stories about "good backups". Based on all of the above, our offer of $1.4 million when paid today still stands, but we will not accept anything below $2 million on Monday. If you refuse and break the deal, we will simply publish your stuff and forget about you.

受害者：Thank you so much for working with us. In good faith we are going to reveal to you that we only have $1,000,000 to work with. We can pay you all of that today. To get any more will be very hard and take many more days. Please accept $1 million and we will get that to you today

威胁者：Please wait.

威胁者：Ok, the leadership has approved that number. Here is a BTC wallet ID for payment: [redacted]

威胁者：How soon are you able to make a transfer?

受害者：We are wiring the money to a broker now. They say a couple hours

威胁者：Ok, standing by.

受害者：To confirm we pay you $1,000,000, and you will deliver whole network decryptors for linux, and windows, promise to not publish or sell our data, provide proof of deletion, and a security audit report?

威胁者：We do confirm the terms.

受害者：and guarantees not to attack us in the future

威胁者：Sure.

受害者：thank you. sending bitcoin shortly

威胁者：Standing by.

受害者：We just sent a test transaction. Please verify and we will send the rest

受害者：Test transaction confirmed on blockchain. Please verify

受害者：Hello?

受害者：We will be back in east coast usa morning to send you the rest

威胁者：Hello. We have received 0.0001 BTC.

受害者：Thank you. Are you ready to receive the rest?

受害者：sending the rest

受害者：Coin sent. Txid: [redacted]

威胁者：We have received, thank you. Please wait for the decryptor first.

威胁者：We will provide everything within 24 hours. Thank you for your patience.

受害者：Thank you for update. We will continue to nervously wait

受害者：Just checking. Please provide what you promised soon

威胁者：decrypt.zip // 479 KB

威胁者：decrypt.exe Name: decrypt Usage: cli args Flags: --path : Start path --secret : Private key --logs : Print logs. Valid values for: trace, debug, error, info, warn. Default: off -h, --help : Show help ---------------------------------------------------------------------- Build information: Version: 2023.9.5 SECRET KEY: "[redacted]" ---------------------------------------------------------------------- decrypt.exe --path --secret : Private key --logs --- decrypt.exe --path C:\\ --secret [redacted] --logs trace decrypt.exe --secret [redacted] --logs trace

受害者：thank you we are working on this now. can you provide a security report or how you got in and what we need to do better?

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security. The evidence of data removal will be provided soon.

受害者：Thank you. We wait for proof of deletion.

威胁者：[redacted] dellogs.rar // 524 KB

威胁者：There are three files in the archive.

受害者：now what?

威胁者：> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

受害者：you took data? what, like you took files?

威胁者：list.rar // 375 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

受害者：We have to pay too, yes?

威胁者：Surely.

受害者：ok. what is the price? what do we get in return?

威胁者：After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. You will receive a deletion log which means the raid drives that contained the only copy of your data are fully formatted and erased. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. I will let you know the price shortly, we're reviewing your financial papers to come up with a reasonable demand to you.

威胁者：So, we've gone through your files to define your financial abilities. We're willing to set a $300,000 price for ALL the services we offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts.

受害者：ANy chance you would share the password for our VCenter? We fear the hardware has now been damaged

威胁者：We didn't change the password for your VCenter.

受害者：well.. our creds do not work.. something is broke

威胁者：Your VСenter was in the quality of a virtual machine on one of the ESXi server. All VMs on this ESXi have been encrypted so you can't login to your VCenter. After payment you will be able to access to any of your data/servers.

受害者：so the host password was changed?

受害者：VMs are encrypted or deleted?

威胁者：Encrypted for sure.

威胁者：The host password was changed, correct. You will get the pass after payment.

受害者：we need to know if the VMs are intact before we pay please...thus need limited access to the host

威胁者：We can't provide, sorry. All we can offer you is to choose 2-3 encrypted files and upoad them to our chat so we can will upload decrypted copies back for you to be calm.

受害者：OK, Im not sure we will want to pay anything if we cant validate that the VMs are just encrypted vs. deleted or harmed in some other way. thanks

受害者：[redacted].jpg

受害者：[redacted]

受害者：[redacted].docx

威胁者：We will provide these files soon. Also will you upload files for decryption?

威胁者：[redacted]files.rar // 1.28 MB

受害者：what is the breakdown of pricing for the services--if we decide to pay?

威胁者：Full decryption assistance costs 150k in your case, the evidence of data removal is 125k and the security report is 25k. All the guarantees are coming as a default.

受害者：ok

威胁者：We need your decision.

威胁者：We will put your name on our blog today.

受害者：as part of the local government, these decisions take everyone getting involved. This means things move slow

威胁者：So everyone involved needs to hurry up. We won't wait long.

受害者：What is your best price ?

威胁者：For the whole deal?

受害者：yes. we are interested in the whole deal.

威胁者：We would accept $250,000.

受害者：OK. i will share your offer with the board tonight or in the AM. Thanks

威胁者：Hurry up on your part please.

受害者：Our board is at this level of approval: $137,000 - Monies over this amount have other local regulatory hurdles.

威胁者：We will discuss internally.

威胁者：The management has decided to accept your offer. I will provide you with a btc wallet ID shortly.

威胁者：Here it is: [redacted] We expect to get payment within next 24 hours.

受害者：24 hrs. yikes! we will do our best. thanks

威胁者：We believe in you.

受害者：They said Monday is the soonest they can pay.

威胁者：We will wait.

威胁者：It is already Tuesday. If we don't receive payment within 24 hours, you will see your name in our blog. Your data will be uploaded before the weekend this way.

威胁者：You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

受害者：We cant gather funds as quickly as you like. Now that you have let evryone know it will be even more dificult to get funds. Why did you do this???

威胁者：We can't read your thoughts. You left us almost 10 days ago and haven't dropped a word. Hurry up on your end. The post will be taken down immediately after payment.

受害者：Is the btc wallet still good to use?

威胁者：Hello. Sure, you can use it.

威胁者：When will we see the transfer? We won't be waiting for another week. We either publish your data prior to weekend or receive the payment and get this over.

受害者：whee is the best/proper place to purchase bitcoin?

威胁者：C'mon guys. If you really wanted to pay, you would have done so a couple of weeks ago. Don't waste our time, please leave this chat. We absolutely do not care about this modest amount, so your data will be published soon.

受害者：where

威胁者：You will know.

受害者：hello

受害者：Hello

受害者：[redacted]

受害者：We would like to un-encrypt our files

威胁者：Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：yes

威胁者：Wait a moment.

威胁者：List.7z // 1.37 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

受害者：how do I open this?

受害者：nevermind.

受害者：[redacted].jpg.akira // 135 KB

受害者：[redacted].jpg.akira // 328 KB

受害者：[redacted].jpg.akira // 136 KB

受害者：Here you go

威胁者：We upload them decrypted soon.

威胁者：[redacted].jpg // 134 KB

威胁者：[redacted].jpg // 135 KB

威胁者：[redacted].jpg // 328 KB

威胁者：Here are the decrypted files. Do you need files for proof?

威胁者：So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us calculate our demand to you. We're willing to set a $250,000 price for ALL the services we offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：Can you please send us these files from the list that you sent?

受害者：[redacted].xlsx [redacted].csv [redacted].pdf [redacted].pdf [redacted].XLS [redacted].pptx

威胁者：Sure. We will provide them soon.

威胁者：[redacted].7z // 5.03 MB

威胁者：Here are the files you can review. We asked for 2-3 files and are giving you back 4 of 6.

受害者：Hello?

威胁者：Are you ready to proceed to payment details?

威胁者：Hello. Will you have a deal with us or we can move to announcing your leak? Let us know.

受害者：Thank you for the unlocked files and the files from the list that we requested. We have been reviewing everything and discussing our next steps and the truth of the matter is that we don't have 250,000 just lying around to send to you. What is the best number you can provide so that we can resolve this as quickly as possible?

威胁者：What is your counter offer?

受害者：All we have on hand at the moment is 25,000 USD that we can send. Is there any way that you can provide us a number that we can maybe work with given what we have currently? At least we can then see if it's doable to gather any more. We don't think there's anyway that we are going to be able to get close to the 250,000 number, but we are trying to gather as much as we can.

威胁者：10% of our demand? Are you sure? We will post your data and delete this chat later if you don't reconsider this modest offer within 24 hours.

受害者：I'm sorry. I appreciate that you feel $25,000 is not acceptable. We do want your services, and we are trying to gather what we can. However, getting capital together is extremely difficult as awe are not a high cashflow business. We may be able to generate a bit more, but I'm not sure. Can you provide us with a more reasonable number given our financial situation? Can you accept $50,000?

威胁者：No we can't. Only 6 figure amount will be considered and at the moment it is $225,000.

受害者：We appreciate the reduction, but the truth of the matter is that we still don't have 225,000. We are still trying to find funds anywhere we can, but our bank is going to want to know exactly where the money is going and they won't allow us to use the funds for something like this. Our only option is to try and gather the funds elsewhere. With that being said, we are actively trying to gather more, but is 225,000 your absolute best number?

威胁者：If your next step will be above six number sum, I'll ask my team if there any additional discount possible.

受害者：Thank you for the consideration. My team is working on seeing what more we can do. At the moment I've only been able to pull together $75k. We just Need more time.

威胁者：Update us on Monday.

受害者：Hello, we've been working on this all weekend and here's what we've been able to do, we can come up to the 6 figure number and offer 100,000, but this is all we will probably have for quite some time. PLease consider our offer and let's gt a deal done.

威胁者：The upper management has decided to provide you with $30,000 discount coming down to $220,000 amount. You can handle this sum with no harm to your business, let's get this over.

受害者：While we appreciate the further reduction, we simply don't have that much onhand and it's going to take quite some time to get any more than we currently have.

威胁者：You have until Friday.

受害者：We are really wanting to get this done quickly, but we simply don't have what you are asking for and we don't know where or how we are going to get any more than the 100,000 that we've offered. We've used up all of our sources of cash. We can send you all of this now, but I don't know when or if we'll have anymore.

威胁者：You still have time until Friday to get more funds. Let's see what you will get and decide how to continue our deal.

受害者：We are still trying to raise further funds, but we aren't having a lot of luck. We'll let you know where we are at tomorrow.

威胁者：Ok, standing by.

受害者：Ok, so we now have 150,000 and just want to get this done and behind us. THis is basically splitting the difference between your price and our's. Please consider our offer, help us out, and let us get on with our business. THanks for your consideration

威胁者：Hello

威胁者：The leadership has agreed to accept your offer. Here is the BTC wallet ID for payment: [redacted] How soon are you going to fund our wallet?

受害者：We are getting the approvals from our bank first and then we will be ready to send the payment. The unfortunate part is that it's the weekend and our bank may not respond until Monday. We will get the request in and let you know once we are sending the funds.

威胁者：Waiting for an update on Monday.

受害者：Payment has been sent to your wallet. Can you confirm and send us what we agreed to pay for?

威胁者：Wait a bit.

威胁者：We confirm the receipt. Please wait for the items.

威胁者：unlocker.7z // 3.04 MB

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line same arguments work with the esxi decryptor

威胁者：We will send the rest withing 24 hours.

威胁者：Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：Yes, I am authorized to speak with you on behalf of our organization. Why would you do this to us? We are a non-profit organization who offers free services for poor and homeless women. This is a terrible thing that has happened to us and you are hurting these women the most by this action. We desperately ask you reconsider what you have done and let us get our operations back to normal as quickly as possible. These people need our help and we need yours to get back to normal. We beg of you to do the right thing here.

威胁者：So, let's do the right thing here settle this quickly and the people you care of will continue getting help.

威胁者：List.txt // 812 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

受害者：So what is it you want from us if you don't care to help reverse what you have done?

威胁者：We're looking through your files to calculate a fair demand to you. I will let you know the sum shortly. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：We need everything back to normal

受害者：We are a non-profit. We don't have much money.

威胁者：We won't ask much money. We will ask what you can afford.

威胁者：So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us calculate our demand to you. We're willing to set a $250,000 price for ALL the services we offer.

受害者：Don't let the financials confuse you. We are a non-profit, meaning all of our funds coming in is not income. It is spent on the free services we provide to more than [redacted],000 women every year. Food, housing, counseling, and many other services to help these women survive. We do all of this for free and all of the money we use for this is donated to us. If we give you that kind of money then it means there are many people that we can't help. That means people that can't eat or have a place to sleep. Please consider being more reasonable and think about if one of these women was someone you care about. Someone you love. You have to have some sense of humanity inside you to do the proper thing here.

威胁者：We are not really confused by your financials. If you care of people and are responsible for them you should protect them. If you take a look at the list we gave you, you would see what kind of information we obtained about the people your are in charge of. How did it happen? They were not protected enough and their documents were stolen. Imagine that docs was someone's you really care about. But as you have a cyber insurance, you can prevent the leak. So do this. Let me know if you are interested in proofs or a test decryption so we can speed everything up. If you act quick, we can give you a 20% discount.

受害者：Please show these 3 files

受害者：[redacted].xls

受害者：[redacted].pdf

受害者：[redacted].pdf

威胁者：Please wait.

威胁者：[redacted].rar // 304 KB

威胁者：Do you want to check our decryption tool?

受害者：yes we want to check, but need to access the files. We don't have them yet

威胁者：When can we expect the files approximately?

受害者：[redacted].vbm.akira // 797 KB

受害者：[redacted].vbm.akira // 515 KB

受害者：[redacted].vbm.akira // 844 KB

受害者：Please show us you can unlock these

威胁者：We will upload them decrypted soon.

威胁者：[redacted].vbm // 797 KB

威胁者：[redacted].vbm // 515 KB

威胁者：[redacted].vbm // 844 KB

威胁者：You can review the files.

受害者：We are going to have to find where we can raise the funds to pay for this. As a homeless shelter all of our money is donations and we don't have this much money so we are going to see what we can come up with. We can get back to you on Monday so that we can hopefully make a deal.

受害者：We just checked these files and there are no changes. They are still encrypted.

威胁者：We will review and get back to you.

威胁者：[redacted].vbm // 796 KB

威胁者：[redacted].vbm // 514 KB

威胁者：[redacted].vbm // 844 KB

威胁者：Please check these.

威胁者：We will wait until Monday for your offer. Have a good weekends.

受害者：As mentioned, it is very difficult for us to have much money. What we are able to offer you at this time is only $50,000. Please understand that as a homeless shelter this is 200 times more money than we started off with as an organization. We rely on this money to serve the homeless community and we still hope and pray you will take pity on us, and offer to get us back for free. If you can find the good will within yourselves that is.

威胁者：We can't accept this modest amount for sure. You had to to start with 6 figure sums at least.

受害者：What are we supposed to do if we don't have that kind of money? We are a charity! Why can't you help us out? We're trying to give you something here. We're doing what we can.

受害者：Is there something you can do for us so we can pay you an amount that you can accept? This is our operational funds we have to use. That means degredation of our services to the people we are helping.

受害者：*degradation

威胁者：We're well aware of you're a charity. We also know that you have enough funds to cover our initial demand. Anyway, the leadership has approved $190,000 amount. The best option for you to get back on track and continue to help people.

受害者：I thank you for working with us. This is greatly appreciated. However, I don't know how to make you understand WE DON'T actually have the funds to cover the initial amount, and to be frank even this amount. This would break us and we would have to shut down. We wouldn't be able to help anyone then. The homeless shelters we have operated for over 50 years would have to shut down. The cold weather is quickly approaching and that would mean thousands of women we couldn't be able to house who will face even more challenges than they already have. In that case it wouldn't make sense to pay you if it means maintaining our survival. I will go back and see what we can do, but we ask you to please do the same. Please visit our website and see our mission and the people who are depending on us. [redacted]. Let's work together on a solution where we all get what we want. I'll get back to you after I see what we can do more.

威胁者：Standing by.

受害者：Because of all the expenses from this incident and what we have to pay to recover we don't have the operational funds on our own to cover everything plus pay you. Luckily I have found someone gracious enough to donate some money to us. The additiional amount we can secure will bring us up to $75,000. Please tell us you will accept this because otherwise we won't have any options left.

威胁者：Thank you for the update. We see that you want to resolve the incident with us, so we can come down with the price and accept $170,000. We can wait a bit for a better offer from you. May be there will be another donation that will allow you to finish our deal.

受害者：Can I speak with your boss or someone else higher? Because I don't think you understand. If we can't work out a deal then you are going to get nothing. I don't know how we can get more to give you.

受害者：I'm having a nervous breakdown here worried sick about our organization. Please answer me. We really need to figure out a solution to this problem. We don't have that kind of money.

威胁者：I'll let you know soon.

受害者：Thank you

威胁者：My team is pretty aware of the situation. It was confirmed to me that we cannot accept any sum less that 6 numbers from you. We'd like to finish this quick but there are rules.

威胁者：Well, we've discussed the case internally. Taking into account your financial situation my leadership decided to move towards you and receive $135,000 for closing the case.

受害者：I wish we had that much to give you so we can finish this process. Unfortunately we do not have that. After moving some things around on our side and making additional cuts, I can offer you $88,500 and then we can be done. That's the best I'm able to do during this difficult time for us.

受害者：I'm hoping this is close enough to 6 figures for you to consider.

威胁者：We see that we are close to the resolving as never before. So we're ready to accept $100,000 within the next 24 hours. So there is an extra discount from us and you have time to gather the sum. I suppose that is the best finish for both sides at this moment. You can fund this BTC wallet when you are ready [redacted]

受害者：I will see what I can do to get there. I'll let you know. Thanks.

受害者：Just so I'm clear, all of these things you said you would give are still applicable? "1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future."

威胁者：Yes, they are.

受害者：Okay thanks. I'll be in touch.

威胁者：Standing by.

受害者：Okay, we have figured out the funding and can pay you $100,000. We will work on getting this to you today. I will let you know more on timing as it gets closer.

威胁者：OK. Thanks.

受害者：We are ready. The address [redacted] is correct?

受害者：hello?

威胁者：Yes, the address [redacted]

受害者：Thanks. Stand by for payment

受害者：payment has been sent

受害者：please confirm you received it

威胁者：We confirm the receipt. Please wait.

受害者：How long do you think it will take?

威胁者：decryptors.zip // 3.04 MB unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line same arguments work with the esxi decryptor

受害者：Thank you. Please provide proof of data removal and the security report on vulnerabilities you found

威胁者：Please wait for the rest items within 24 hours.

受害者：Any update for me?

威胁者：Wait a bit.

威胁者：Deletion [redacted].txt // 2.05 MB

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

受害者：Hello, our servers have been locked down and we would kindly ask that you unlock us. We're a small family business and rely on our computers. Thank you.

受害者：Hello

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：Can you tell us what do you expect for unlocking us? We need our servers back. Thank you.

受害者：yes I have

威胁者：[redacted]_lisling.txt // 2.22 MB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：We're interested to see the pricing 1,2,3,4,5 to understand.

受害者：So whole deal

受害者：Hello, can we get offer?

威胁者：Sure. Wait a bit.

威胁者：The full package will cost you $180,000 where the full decryption assistance is $100,000, the evidence of data removal is $70,000 and the report is $10,000. All the guarantees are coming as a default.

受害者：We beg for lower price. This is huge amount for our company. Can we please get price of several 10k? This is really huge. I beg you on behalf of myself, my family and our employees.

受害者：Please

威胁者：Are you interested in the full package, right? If you're able to arrange payment within next 2-3 days, we will consider a discount but it won't be more than 20%.

受害者：We could pay in 2-3 days 40.000 USD for decryption and I would ask that you do not attack us again and remove data.

威胁者：$140,000 and you will receive all of our services.

受害者：I ask you to support us. We are people as you are.

受害者：We are not corporation

受害者：This is how much we can give now for decryption, that we can recover data and then we negotiate further.

威胁者：I understand the situation you're in. I don't make decisions here, I'm just a mediator. So, please manage to gather more funds and my bosses will be able to help. We have our internal policy and we can't accept such small amounts. Thank you for understanding.

受害者：Plaese

威胁者：Raise your amount up to 6 figures and we will shake hands.

受害者：I would kindly ask for your answer on our last request.

受害者：60.000 USD plis

受害者：Plis

威胁者：$120,000 and we will shake hands.

受害者：We can pay 70k maximum. Please, we are a small business, which has to fight everyday for every penny. For us this is shock. Please spare us. Let's find agreement in this reasonable amount.

威胁者：We highly appreciate your willingness to work with us and see how you value your business but we cannot accept this amount. We've had a meeting as result of which the upper management has decided to take another step towards you and come down to $105,000. Let's just split that difference between you and us and get this over. Once you confirm the sum I will drop off our wallet and we will start preparing all the deliverables.

受害者：Hello, we accept 105.000 USD. How do we know we will recieve full package and trust thigs will be settled and we will not be attacked again? Will we recieve full package? How do we pay?

威胁者：That's good. After we receive the transfer we will provide you with the decryption tool and the rest including our guarantees not to attack you again. You will be provided with our BTC wallet id soon.

威胁者：Here is the BTC wallet [redacted] Let me know when can we expect the transfer.

受害者：I assume this is Bitcoin payment. We don't have Bitcoint account in our company and I am also not using it personally. I have started the procedure of opening account personnally becuase it is much faster than opening for company. I still need to transfer the money from company to my personal account, then to Bitstamp, then to yoiur wallet. I am now waiting from the bank if they can send me money on my personal account as our payment system is encrypted. Then I hope that Bitstamp will proceed fast and that we settle all this today. How long it will last that we get all above after you recieve payment? Thank you.

受害者：We would like to be sure that decryption is working. Please can you send us files /home/[redacted].pdf /home/[redacted].pdf /home/[redacted].pdf

受害者：Also we would like to be sure that decryption key is working. You encrypted our virtual environment so we dont have access to files only vmdk files. Can we upload vmdk file?

威胁者：You will receive all the decryptors immediately after payment. Please upload vmdk file. We will provide you with requested files soon as well.

受害者：Hello, I am waiting for the money to land on Bitstamp, then I will first transfer 0.01 BTC for you to confirm me that you have recieved. Then the rest (and after test on above files)..

受害者：[redacted].vmx.akira // 4.6 KB

受害者：[redacted].log.akira // 1.86 MB

受害者：vmdk is not possible to upload it's 16 GB

威胁者：We will decrypt the uploaded file. Please wait.

受害者：Hello, when can we expect decrypted files?

受害者：We have now transferred our funds to Bitstamp, however they have blocked us due to new account and unusualy high amount and the case is opened there, that we will be able to make payment.

受害者：[redacted] - Bitstamp.pdf // 44.3 KB

受害者：Hello, we would really ask for soonest resolvment. Please.

威胁者：Hello. Please be patient with us. We will provide everything shortly.

威胁者：[redacted].log // 1.86 MB

威胁者：[redacted].vmx // 4.09 KB

受害者：Thank you. Files are ok.

受害者：I have opened personal account on Bitstamp and put on the account 105.000 USD. I am now in compliance procedure on Bitstamp due to high transaction amount and we are pushing on them to release the security limits, that we can transfer funds. We will inform you immediatelly.

威胁者：How's your progress with payment?

受害者：I have opened personal account on Bitstamp and put on the account 105.000 USD. I am now in compliance procedure on Bitstamp due to high transaction amount and we are pushing on them to release the compliance limits, that we can transfer funds. We will inform you immediatelly.

受害者：[redacted] - Bitstamp.pdf // 44.3 KB

受害者：in pdf printscreen from Bitstamp. I hope they solve this asap, that we send payment.

威胁者：Thank you. Keep us updated please.

受害者：I have just got information from some people in slovenian Bitstamp that we can expect answer from compliance department tomorrow.

威胁者：Ok.

受害者：Good morning. I still wait for Bitstamp to open my account for buy BTC and transfer it ...

威胁者：We are waiting.

受害者：Hello, I am unfortunatelly still waiting for Bitstamp to release my trading despite many urgencies. Printscreen in attachement.

受害者：Status at Bitstamp.jpg // 85.6 KB

威胁者：You need to assure them that you use your funds in investment purposes.

受害者：Hello, we didn't recieve any response from Bitstamp yet and as I understand my Bitstamp account is under red flag as I put in so big amount of money. We are desparate and our business has started to seriously suffer and orders are being canceled as we can't operate :(. Can you please decrypt us? We will pay anyhow. Can you help us how to pay?

威胁者：We can't provide anything before payment. I will learn how we can help.

威胁者：What has Bitstamp support responded?

威胁者：Could you please give us more details?

受害者：They have responded only that they are processing and phone support is saying that it is in compliance department and has been escalated to higher level. We have contacted some people from Bitstamp here in Slovenia to help us accelerate the process there. Hope to get answer asap. I have today opened account also on other exchange and I will try to proceed also there (Swissborg) if Bitstamp doesn't work. Can you help me what are other options?

受害者：Status Bitstamp [redacted].jpg // 101 KB

威胁者：Please wait.

威胁者：To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. Additionally, maybe this title will help: https://www.csoonline.com/article/570047/how-to-buy-bitcoin-for-ransomware-payment-if-you-must.html

受害者：Thanks for that info. We have done exactly that with second account on [redacted]. For investment purposes only. I will read your link and I sincerely hope that tomorrow this will be settled.

威胁者：We hope too. Thank you.

受害者：Good morning. Just update. Payment went this morning from my bank to Swissborg. I will keep you informed during day on progress.

威胁者：Thank you.

受害者：Hello. I am providing latest update. Today at 8:45 AM I have paid money to [redacted] bank account in Malta and now I am still waiting that their system processes the payment and that this payment will be shown in my [redacted] app on the phone. They say that it takes 1 to 3 days. Since I have paid by SEPA payment I assume that the money should be visible in the app if not today, latest on Monday. I have checked in advance compliance procedure on [redacted] and I have all documents for compliance ready, so I don't expect any problems with compliance and I will then buy Bitcoins and transfer them to your wallet. Thank you for patience.

受害者：If you need some information for proof of above happening let me know. Bitstamp has stolen us two days.

威胁者：Thank you for update. We're standing by.

受害者：Good morning. I am waiting that money comes on crypto account...

威胁者：Morning. We're waiting too.

受害者：Hello. I am desparate to write, I still haven't succedeed to transfer money from my bank account to my [redacted] account. I have sent money on Friday at 8:45 trough [redacted] bank in Slovenia and they sent me confirmation on Friday. Today they have called me that their [redacted] mother bank couldn't send the money to [redacted] account on Malta. I went today at 15:30 in person to [redacted] bank here in Slovenia and they told have made SEPA payment, so I expect that I will have money on [redacted] account tomorrow. I am totally frustrated, because of this, but I can't help. I believ e that money will arrive to this [redacted] account and that I will buy and forward BTC's tomorrow. We really need unlocking here. People inthe company have become totally depressed and me too. We will solve this payment and then really ask for decryting to be made available urgently that we can start decripting immediatelly. Thank you very much in advance.

威胁者：You will get the decryptors immediately after payment.

受害者：Morning. I see money went from my [redacted] bank this morning. Now I wait for it to pop up in my [redacted] app... Keep you informed.

受害者：Hello, I have just tested BTC withdrawal for 0,008 BTC from my [redacted] account how it works. Could you please check if you've recieved. On [redacted] I have otherwise only 11.000 EUR monthly limit, so I will still have to wait for [redacted].

威胁者：Haven't received anything yet.

受害者：It took some time. Now I see on blockchain.com that there is 0.008 BTC in above specified wallet [redacted]. Can you recheck?

受害者：Can you please check and confirm that you have recieved 0.008 BTC ?

威胁者：0.008 BTC received.

受害者：Thank you. I am doing everything that you will recieve difference to 105.000 USD within next two hours and will keep you updated. I would really kindly ask that we get this decryptors then as soon as possible that we can start decrypting today. Thank you.

威胁者：Thank you. We're ready.

受害者：Hello, my contact is in GMT+9hrs time, so I wait that he wakes up and transfers. I will be online again around midnight CET time.

受害者：Banks are taking too much time.

威胁者：Got it, thanks.

受害者：Hello, just to inform that payment of [redacted] btc has been initiated.

受害者：Enclosed you find transaction link

受害者：https://blockstream.info/tx/[redacted]

受害者：I would now kindly ask that you provide us as discussed full package: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.

受害者：We will learn from this...

威胁者：I see. Unconfirmed yet.

威胁者：unlockers.7z // 1.55 MB

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line same arguments works with esxi decryptor

受害者：Hello, thank you for unlocker. Can we please get instructions how to unlock Vmware platform?

威胁者：There is a different unlocker for each system.If it's ESXi - you should use the decryptor for linux.If we're talking about Windows, you should use the .exe unlocker.unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line same arguments works with esxi decryptor

受害者：Hello, when can we expected of delivary 2) evidence of data removal; 3) security report on vulnerabilities we found;

威胁者：I will provide in an hour.

威胁者：[redacted]_dellog.txt // 2.54 MB

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We guarantee that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

受害者：Thank you!

受害者：Is it possible to share what means initial access? Which username (I assume also password) was available on dark web?

受害者：At least info on username and if password was also available? Thank you.

威胁者：It was VPN credentials. We get access from different people on the darknet, this information is not in public domain. We recommend that you change your VPN credentials and reconsider your password policy - there is nothing to worry about anymore.

受害者：Thajnk you!

威胁者：You're welcome.

受害者：I don't unnderstand what this is.

威胁者：Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：Yes, I am the IT admin assitant.

威胁者：listing_[redacted].txt // 724 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price. If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.

受害者：I guess we need decryption assistance.

威胁者：We'll let you know our price for the decryption tool soon.

威胁者：> We accept payments in bitcoins. To gain bitcoins you have to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. We are the ones who can properly decrypt your data and restore your infrastructure in a short period of time. After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. You will be able to restore your infrastructure within 24 hours. If you face any problems during decryption process, we will be here to support. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. Our price is $200,000. Once you confirm the sum, I will drop off our wallet ID.

威胁者：For $250,000 we will also delete your data.

受害者：can you show me these files: [redacted].doc [redacted].pdf [redacted].xlsx [redacted].xlsx [redacted].docx [redacted].docx

受害者：also here are some files for a test of the decryptor

受害者：[redacted].doc.akira // 1.86 MB

受害者：[redacted].pdf.akira // 115 KB

受害者：[redacted].xlsx.akira // 14.7 KB

威胁者：Please wait.

威胁者：files.rar // 4.29 MB

威胁者：Here are the proof files.

威胁者：[redacted].doc // 1.86 MB

威胁者：[redacted].pdf // 115 KB

威胁者：[redacted].xlsx // 14.2 KB

威胁者：Here are the decrypted ones. Ready to move to payment?

受害者：Appreciated. We are scrambling to offer any amount as we are completely in unknown territory here. Can we reach a deal of 50,000? this is a lot of money for us.

威胁者：We appreciate your offer but it is far away from a fair deal that we're here trying to reach. As a goodwill, we're willing to accept $200,000 which is capable for you to handle. You're well aware of the financial and reputational consequences in case we fail to agree. Let's be objective.

受害者：We understand and this is why we attempt with approval to offer 95,000 to reach the deal with you.

威胁者：I'll discuss with my team and be back here.

威胁者：So, we can accept $150,000 as final. We won't go any lower. Here is our BTC wallet [redacted] It's up to you.

受害者：We understand and agree to the 150,000 amount.

受害者：If you can confirm these deal points, then we have reached a deal -

受害者：1. Decryptors right away, and full decryption assistance

受害者：2. Confirmation of which files you exfiltrated -- full file list

受害者：3. Guarantees never to publish or sell our data -- or to publicize or leak anything about this incident

受害者：4. Guarantees never to attack us or our customers in the future

受害者：5. Physical copy of all data exfiltrated -- provide a link to download

受害者：6. After we download the data, your evidence and secure proof data deletion

受害者：7. Information about how you entered our systems -- security report

受害者：8. When we approve, you will delete this chat and all logs and other data about this incident

受害者：Please confirm and let us know when you are online to give us decryptors

威胁者：We confirm. I'll provide our BTC wallet soon.

威胁者：Here is the wallet: [redacted] How soon should we wait for a transfer? We expect to get payment before the weekend.

威胁者：The terms we agreed on are valid before the weekend.

受害者：Confirmation is appreciated.

受害者：We will make the transfer this morning. Please prepare the decryptors to transfer to us right away

受害者：We see 2 wallets in chat. Please confirm we should transfer to lastest one: [redacted]

威胁者：We're prepared.

受害者：OK, we will send shortly to wallet: [redacted], standby

威胁者：Waiting.

受害者：transfer completed. you can check it

威胁者：win_unlocker_[redacted].ex_ // 759 KB

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line

威胁者：We've started uploading your data to mega storage. This process will take us 2-3 days approximately.

受害者：Thanks, received. When will you provide the data dowload link?

威胁者：See the message above.

受害者：yes, the chat did not refresh

受害者：Can we receive the security report and information about how you entered our systems

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc.

威胁者：mega.nz [redacted]@proton.me w[redacted] archive password: [redacted]

受害者：one of the files did not upload correctly can you please re-upload the file called [redacted].part6.rar

威胁者：This file is correct. The downloading was interrupted and this archive was corrupted. We can't do anything with this.

受害者：so you cannot re-upload it again?

受害者：hello? the file in the mega one of the is not complete. You stopped the upload can you put it there again please and if something is wrong, can you say what files were there?

威胁者：I've passed it to my team. Please wait.

受害者：Hello, how is this file re-upload progressing?

威胁者：Hello. This archive cannot be re-uploaded because it was corrupted while we downloading this FROM your network. We got this archive like this. Sorry for misunderstanding.

受害者：Okay thanks for your help. Can you please delete all data you have about the situation and provide evidence of secure deletion?

威胁者：Sure. I'll provide the file within 12 hours.

威胁者：Deletion.7z // 87.3 KB

威胁者：Apologies for the delay.

受害者：hello

受害者：hello

受害者：hello please help ME

受害者：hi

受害者：is somebody there

受害者：we are very small company...

受害者：??

受害者：???

受害者：hemlo Mister

受害者：Please helo please help

受害者：is somebody there

受害者：Hello....

受害者：It is our existence... please please help us

受害者：Hello

受害者：mister

受害者：hello

受害者：hellooo

受害者：akira

受害者：team

受害者：helooooo

受害者：akira

受害者：hello

受害者：😭😭😭😭

受害者：hellooo

受害者：is u there??

受害者：hellooo

受害者：helloooo

受害者：helloooo

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：yes i am the owner of the company. Its a family business.

受害者：we are a small company with not many people and all my family members work here. you didnt hack a big company. this situation is very bad for us and to be honest we dont have much money because work is not going good.

受害者：PLEASE.....😭😭😭😭

威胁者：Wait for details.

受害者：hello sir

威胁者：We didn't take your data. We are the ones who can properly decrypt your data and restore your infrastructure in a short period of time. After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. If you face any problems during decryption process, we will be here to support. You will receive a security report that includes information about how we were able to penetrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. The price is $100,000. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back.

受害者：100,000$ is way too much. We as a family run business dont earn that kind of money. i wish i could pay it but there is no way we can afford that. we have already money problems right now and i can barely pay my employees salaries. you are about to destroy my families and my whole life. why do you attack a small business like us and not a big coorperation? everybody im my office is devistated and some are even crying because of this situation. the only thing i can do is please pay a maximum of 5,000$. i am sorry but i really cant afford more. please do it for my family and hard working honest employees. dont destroy our lives. we all need this company.

受害者：PLEASE .....

威胁者：unlocker.7z // 1.24 MB

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line ESXi commands 1) chmod +x unlocker 2) ./unlocker -p="/vmfs/volumes"

受害者：thx u very much ✌️✌️✌️✌️✌️

威胁者：You are welcome!

受害者：sorry for bothering you but i am trying it the whole time but i cant make it work. can you please explain what i exactly have to do ?

受害者：😭😭😭😭

威胁者：You have instructions. Tell me at what stage you are having troubles.

受害者：thx u very nuch......u are my Angel

受害者：i can not repair the database

威胁者：Provide more details. What kind of error did you get?

受害者：😭😭😭😭😭😭😭😭

受害者：we sqlserver can not attach the database

受害者：is it normal??

受害者：[redacted].jpg // 4.82 MB

受害者：before decode

受害者：before decode

受害者：[redacted].jpg // 5.71 MB

受害者：what gone wrong? PLEASE PLEASE HELP

受害者：we thought the server had hung up and restarted the server. could it possibly be related to this?

受害者：and some files is ending with arika .file

受害者：I have a question because I am trying to fix something the whole time but I can't. We thought that the server was down so we restarted it. Could it be possible that during that progress some files that started to be encrypted got damaged and can't be decrypted now ? Because my most important .mdf files don't work anymore. Could you please assist me ?

受害者：PLEASE

受害者：😭😭😭😭😪😪😪

受害者：😭😭😭😭😭

受害者：do u have an idea??

受害者：??

威胁者：Yes, the interruption of decryption process could damage files. Send me logs and I will ask my tech team.

受害者：how u penerate our nrtwork? can u give me info please...

威胁者：Initial access to your network was purchased on the dark web.

受害者：how can i find it?

受害者：how it happen?

受害者：access about email, router,client?

受害者：how can i make beter or save?

受害者：Thank you for your answers and patience with us

受害者：Is there a new access, do I understand it correctly?

威胁者：You have already get decryptors for free. I've provided you with more than enough info.

受害者：thx 🥰

受害者：Please confirm this message

威胁者：Hello

威胁者：You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：Yes I do

威胁者：Please wait.

受害者：Just checking you are still here?

威胁者：We are. Wait for the details.

受害者：Do you have the details yet?

威胁者：[redacted].rar // 371 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：We need a few days to look at the list and pick 2-3 files. Ill get back to you on monday

威胁者：Standing by.

威胁者：Hello. I am waiting for the files.

威胁者：So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $300,000 price for ALL the services we offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price. Atm, we highly recommend that you refer to your cyber insurance to cover our amount quickly minimizing all upcoming risks.

受害者：Thank you for this update. I will get you the filenames very soon and we will also discuss the price you have shared

威胁者：Standing by.

受害者：1. [redacted].pdf 2. [redacted].xlsx 3. [redacted].docx

威胁者：[redacted].rar // 541 KB

受害者：I'll review these today

威胁者：We have to proceed to payment options.

受害者：Ok but first I need to see proof of decryption assistance. I will get you files today

威胁者：Standing by.

受害者：[redacted].xml.akira // 518 KB

受害者：[redacted].akira // 749 KB

受害者：Here

威胁者：Please wait.

威胁者：[redacted] // 748 KB

威胁者：[redacted].xml // 517 KB

受害者：Thanks. Is it expected that the files become 1kb smaller after decryption?

威胁者：Yes, it is.

威胁者：Ready to move to payment?

受害者：We have no more questions at the moment. We confirm your abilities to recover the data and the details about our files. I am meeting with our boss in the morning to go over our next steps and I will check in with you after that

威胁者：Waiting for the update.

受害者：Here is the update. We have taken note of what is still encrypted and the financial impact of losing it or rebuilding it. I am running the numbers again to confirm but I dont think it amounts to the $300k that was quoted. To discuss payment, we would hope to see a revised quote, if that is something you can provide.

威胁者：Let me know what sum you see reasonable and I'll discuss it with my team.

受害者：I will confirm our assessment with my boss and get back to you after the weekend

威胁者：Waiting.

威胁者：so?

威胁者：You have 24 hours to give us your decision regarding this deal. If you stay silent, we will announce the breach on our blog.

威胁者：You can find your company name in our news column: akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion If you want this post to be removed, we have to agree on something.

威胁者：Your data will be available for downloading soon.

受害者：Hello there

受害者：Anyone there

受害者：How do we obtain a recovery key?

受害者：akira_readme.txt // 2.68 KB

受害者：HELLLOOOO!!!!

威胁者：Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：Yes

威胁者：list.txt // 208 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：Whole data

受害者：Hello

受害者：Hello

受害者：Hello

受害者：Hello

受害者：Hello

威胁者：Wait a bit.

受害者：Hello

威胁者：So, we've gone through your files to define your financial abilities. We're willing to set a $275,000 price for ALL the services we offer.

受害者：i would like to appeal to you. We are a small company of only 5 employees. We are willing to pay, we just need this to be a resonable amount that we can afford to pay without going bankrupt. Please reconsider and we will like to work with you.

受害者：We have to pay out of pocket, we do not have any insurance for this.

威胁者：Show me what do you have now and I'll talk to my team.

受害者：i have 50K i can spend now.

威胁者：We won't be able to settle this at 50k. I think the best we can offer is a 50k discount but I need to talk to my team. We work with 6 figures only.

受害者：if you can work with 6 figures can you do 100K? i dont have that cash at the moment but i can get a loan. Can we start with a few VMs to prove it works?

威胁者：$175,000 and we will get this over. We can't go any lower. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 mb each to our chat and we will upload decrypted copies back.

受害者：please reconsider. can you take 125K? it will be a struggle at that price for us.

威胁者：Guys, first of all, 100k discount seems huge enough. Secondly, we've set a fair price initially, so you can handle that with no problem. Let 175k be the final number since this way both of us are satisfied.

受害者：how long can you give us to come up with the money?

威胁者：The discount is available till Saturday.

受害者：can you tell us how we need to go about paying you?

威胁者：We accept payments in bitcoins. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.

威胁者：Let me know when you are ready and I'll provide our wallet id.

受害者：Hold on. My team is working with the finance department to see what additional funding (if any) we are able to come up with. In the meantime we have some additional questions. Can you provide the following files (below), let us know how much data was taken, and is the file list you provided a full file list? E:[redacted].pdf E:[redacted].pdf E:[redacted].pdf E:[redacted].pdf E:[redacted].pdf E:[redacted]3.pdf E:[redacted].pdf

威胁者：This is the complete list. We have about 2gb of data. The files will be provided shortly.

受害者：Our finance department needs additional time to see if they can find additional funding, we will need a few more days. But I will keep you updated as much as possible.

威胁者：Make everything ready by Tuesday. We'll close the deal.

威胁者：files.rar // 711 KB

威胁者：You can review the files.

受害者：downloading now and will review with my team. can you decrypt these files for me.

受害者：encrypted.zip // 19 KB

威胁者：I'll upload them decrypted soon.

威胁者：decrypted.zip // 9.88 KB

威胁者：You can check the files.

受害者：thank you, downloading these now. i will keep you updated.

受害者：After careful consideration and very extensive discussions, we have reached our maximum budget capacity of $135,000. It's important to understand that this figure already stretches our financial limits well beyond the available funding. The amount we're proposing is a significant six-figure sum that we are paying out of our personal pockets. Please accept! we can make payment immediately. Please recognize our constraints and work with us.

威胁者：We see your intentions to resolve this so we can accept $150,000 and close the deal. There is a little gap between us and I think there shouldn't be a problem for you. Here is our BTC wallet [redacted]. Let me know how soon can we expect the transfer.

受害者：We appreciate the additional discount. However we explained to you our financial situation and we cannot come up with that amount. I have been authorized to offer you 140k. Any more than that amount will put us out of business. It is still a significant six figure payment to you. Please accept, and let's both walk away happy.

威胁者：ok you can send $140k to the same wallet from my previous message. How soon can we expect the transfer?

受害者：Just to confirm we pay you $140,000 to BTC wallet [redacted] today, in return we will receive whole network decryptors, a deleteion log showing you deleted our data from your servers, a security audit report in detail on how you attacked us, a promise to never attack our company again, and the Domain Admin password to our AD environment to begin recovery as it was changed and we cannot login.

威胁者：We confirm the terms and the wallet id [redacted]

受害者：thank you, we are preparing to send.

受害者：payment has been sent

受害者：https://mempool.space/tx/[redacted]

威胁者：Received. Please wait.

威胁者：unlocker.7z // 1.77 MB

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line ESXi commands 1) chmod +x unlocker 2) ./unlocker -p="/vmfs/volumes"

威胁者：You will receive the rest within 24 hours.

受害者：can you give us the domain admin password? we are unable to login

威胁者：Yes. Please wait.

受害者：we are having issues with a large file. it is 5.3tb the error is below

受害者：file_logger error Open file with share check!

威胁者：I'll pass this to my team. Pleas wait.

受害者：can you provide the domain admin login

威胁者：net user [redacted] [redacted] /dom net user [redacted] [redacted] /dom

受害者：thank you. additionally we were able to decrypt the large file without error. when can we expect to receive the remaining deliverables?

威胁者：You will receive it within next 24 hours. Sorry for delay.

受害者：okay thank you

威胁者：log_erase [redacted].txt // 2.06 KB

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We guarantee that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

受害者：To confirm: Your access method was VPN correct?

威胁者：Correct.

受害者：Please disclose the account leveraged as apart of the compromise, since you noted that you purchased the method of access.

威胁者：My team says we have no longer that information. You just need to follow our instructions and change all the credentials. Renew it from time to time.

受害者：One of your deliverables was to furnish a security report, no such thing has been delivered, and for you to claim you don't have the original login used, means you're not furnishing any real report here. Please take 15 minutes to provide us a detailed write up on how you breached the network, what accounts were used, what site those credentials we're found on. Telling us to advise our client to simply change their passwords is not adequate when you just benefitted off of their downfall to the amount of $150,000

威胁者：This info doesn't cost $150,000 for sure. We used their VPN credentials to get into. We get access from different people on the darknet, this information is not in public domain. We recommend that they change your VPN credentials and reconsider their password policy - there is nothing to worry about anymore. You won't get more info than that.

威胁者：We used ZeroLogon sploit. They need to patch their DC.

受害者：ZeroLogon exploit might have been how you got domain admin, it wasn't how you got on the VPN. You committed to a report, Zero Logon has already been patched as a completely brand new environment was built so that's not a concern. The concern is wanting to know WHAT ACCOUNT you used that you found on the dark web to breach the VPN

威胁者：Guys, we do not collect this info. We've provided you with all we had.

受害者：You aren't providing everything you have, you aren't even providing us the account that was used in the breach, which SHOULD be apart of your security report.

受害者：[redacted]

威胁者：Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

受害者：I am reaching out to you on behalf of [redacted], in response to the recent security incident they have experienced. As an authorized third-party negotiator, I have been entrusted with the task of facilitating a constructive dialogue between your team and our organization. Firstly, we would like to request a detailed list of your demands to understand the scope and nature of your requirements. This information is crucial to proceed with any discussions and to assess the feasibility of meeting these demands. Secondly, for verification purposes and to ensure the integrity of our negotiations, we kindly ask you to provide proof of the data that has been compromised. This should include a comprehensive list of all data that has been accessed, copied, or encrypted. This step is essential for us to evaluate the situation accurately and to take appropriate actions from our end. We are committed to finding a resolution to this situation and hope that we can engage in a professional and constructive manner. Please send the requested information at your earliest convenience so that we can move forward with the negotiation process. We await your prompt response.

威胁者：Wait a bit.

威胁者：List.zip // 712 KB

威胁者：These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

威胁者：We're looking through your files to calculate a fair demand to you. I will let you know the sum shortly. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

受害者：While this is some of the files from one server, It would seem that you either haven't provided us a full list. There are critical application servers that run databases that is the main concern at this time to operate the business.

受害者：Do you simply encrypt the files and not take copies of the data from those systems?

受害者：My client is interested in Decryption and Guarantees the data will not be published. Please provide a fair and reasonable price. This company cannot afford hundreds of thousands of dollars, and they are open to a quick transaction. They require proof that the data can be decrypted, specifically their SQL and Application Servers.

受害者：One of those application servers has a readme text file with a code of [redacted]

威胁者：We've encrypted your some of your servers and took the data you see in the list.

威胁者：We'll give you the demand after we study your financial files. Give me 2-3 files about 10mb size to test our decryption tool.

受害者：Not sure if that makes any difference

受害者：Understood. My client needs proof that if they pay any fees to help decrypt, that it is going to work. Do you have a way for them to test decryption on one of their business critical systems? As for files taken, while its a concern, it's a smaller concern at this time. Please provide copies of the following files as evidence:

受害者：file_request.txt // 1.61 KB

威胁者：We decrypt the files you give only. The tool will be provided after the payment and you will be provided with our assistance if needed. If our tool didn't work, we wouldn't be ever paid. Please wait for the files.

受害者：There is no need to study anything, you won't get anywhere by reviewing them. My client needs a quick resolution to restore business service today, they are interested in immediate and quick resolution. If they are unable to achieve this today, there won't be any money to even offer you as it will result in them going out of business.

威胁者：So, are you going to have a deal here?

受害者：A deal? We're still waiting for proof of decryption, we're also waiting on your price. You've given us nothing.

受害者：[redacted].xlsx.akira // 2.75 MB

受害者：[redacted].xlsx.akira // 522 KB

受害者：If my client is unable to print papers tomorrow, they will completely go out of business and not be able to pay you a dime. Please prioritize your review and provide us the decrypted files to confirm this will work

受害者：And please identify your demand for decryption + keeping their information off of the internet.

威胁者：Hello. We're here, please wait.

威胁者：[redacted].xlsx // 2.75 MB

威胁者：[redacted].xlsx // 522 KB

威胁者：There were technical issues on our end, so I wasn't be able to contact you earlier.

威胁者：$4M and we're ready to close this today.

受害者：4 Million? You have our financials, you can clearly see that isn't going to be possible.

受害者：However, the amount you are asking for is beyond our capacity. As a gesture of good faith and our intent to resolve this matter amicably, we are prepared to offer $50,000. This amount represents a significant stretch for our organization but reflects our earnest desire to find a middle ground. We believe this offer is reasonable considering our situation and hope it demonstrates our willingness to cooperate. We request you to reconsider your demands in light of this offer. Ensuring a quick and fair resolution would be in the best interest of all parties involved.

威胁者：50k won't work. I'll let you know a bit later.

威胁者：We have rechecked your financial papers, so we're willing to come down to $1M. We won't ever consider 5 figure sum and I guess 6 figures too. Let me know your decision promptly, since we have lots of clients interested in talking.

受害者：Lets be realistic, you have our financial data for a [redacted] company... It's 2024, everything is digital and online. If you looked at the financials, you would see that my client is incapable of affording 1 million. There is no competitor to sell the information to. All you would be doing is destroying a business, and getting absolutely nothing for it. I will need some time to discuss further with my client, but in the mean time I ask that you please actually review the financials. There is no possible way to settle this matter for a sum of 6 figures, however I'm confident if you can bring the price down to a 5 figure settlement for Decryption and deletion of the data on your end, we'll be able to come to a swift resolution.

威胁者：Again, 5 numbers won't be considered. We will see what you are going to bring us with the next update and decide how to proceed with the case.

受害者：I will speak with my client tomorrow, however I emplore you to re-evaluate the situation. This is a [redacted] company in a world where everything is online. The financials, which are in your possession, show there's no profits being made over here. Revenue does not equal profit. We are prepared to make a deal, but one from reality. I will discuss with them further tomorrow, but you will not see 7 figures.

威胁者：Let's see what your client thinks about that.

受害者：I have spoken with my client, and a 7 figure settlement isn't going to happen, nor will 6 figured. I've been approved to offer 65k. My client has filed Chapter 15 bankruptcy, you can see it's all over the internet if you simply google.

受害者：They are prepared to swiftly resolve matters before they're unable to do anything do to the bankruptcy. They would like to decrypt their systems. They do not care about their financial data being published online, the reality is it already will be due to the bankruptcy filing.

威胁者：I am not sure we can settle this with you. I'll get back later.

受害者：We both know you can settle this, lets come to an amicable agreement. You can clearly see the hardship this has created, against a company that was already experience financial hardship.

威胁者：My team can accept 100k the lowest.

威胁者：Are you going to work with us?

受害者：I will have you an update by end of day today

受害者：To confirm, the 100K will result in assistance fully decrypting their systems, evidence of data removal, a security report on the vulnerabilities exploited, guarantees to not sell the data, and guarantees you will not attach again?

威胁者：$100k is the lowest price. We can give you our decryption tool or data removal evidence for this amount. Each of these options costs $100k, our report is for $25k.

受害者：For decryption only, I'm authorized to offer 75k only. If you are willing to do both decryption and removal evidence, they will pay 100K. Please advise which route you will accept, and provide the bitcoin address.

受害者：Please let us know immediately, my client is ready to close this out and get their data back.

威胁者：$100K for decryption OR data removal only. Here is our BTC wallet [redacted]

威胁者：I've just been told that we can complete this deal (all 5 options) with you for $150,000.

受害者：Please let me consult with my client on the option you presented. I'll be in contact shortly.

受害者：My client accepts your offer. I'm in discussions with our partner that facilitates the crypto transaction, it should be completed within approximately 24 hours. Once completed, please advise to the what the next steps are for obtaining access to your decryption tool and assistance in reversing the damage done to our clients systems / data.

受害者：https://blockstream.info/tx/[redacted]

受害者：I show payment was delivered, please provide us the decryption tool so that we can restore business operations

受害者：Please advise

受害者：It's been nearly 24 hours without a response from you, please provide an update.

威胁者：Please wait.

受害者：Please provide update

威胁者：esxi5.5.zip // 1.94 MB

威胁者：chmod +x akira_v2 ./akira_v2 --logs trace --path /vmfs/volumes/ --secret id

威胁者：secret id is [redacted]

威胁者：esxi6.5 +win.zip // 2.29 MB

威胁者：unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line ESXi commands 1) chmod +x unlocker 2) ./unlocker -p="/vmfs/volumes"

受害者：We're working on confirming decryption now. What about the other deliverables?

威胁者：dellog_[redacted].zip // 382 KB

威胁者：Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We guarantee that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

受害者：To confirm: Your access method was VPN correct?

威胁者：Correct.

受害者：Please disclose the account leveraged as apart of the compromise, since you noted that you purchased the method of access.

威胁者：My team says we have no longer that information. You just need to follow our instructions and change all the credentials. Renew it from time to time.

受害者：One of your deliverables was to furnish a security report, no such thing has been delivered, and for you to claim you don't have the original login used, means you're not furnishing any real report here. Please take 15 minutes to provide us a detailed write up on how you breached the network, what accounts were used, what site those credentials we're found on. Telling us to advise our client to simply change their passwords is not adequate when you just benefitted off of their downfall to the amount of $150,000

威胁者：This info doesn't cost $150,000 for sure. We used their VPN credentials to get into. We get access from different people on the darknet, this information is not in public domain. We recommend that they change your VPN credentials and reconsider their password policy - there is nothing to worry about anymore. You won't get more info than that.

威胁者：We used ZeroLogon sploit. They need to patch their DC.

受害者：ZeroLogon exploit might have been how you got domain admin, it wasn't how you got on the VPN. You committed to a report, Zero Logon has already been patched as a completely brand new environment was built so that's not a concern. The concern is wanting to know WHAT ACCOUNT you used that you found on the dark web to breach the VPN

威胁者：Guys, we do not collect this info. We've provided you with all we had.

受害者：You aren't providing everything you have, you aren't even providing us the account that was used in the breach, which SHOULD be apart of your security report.

威胁者：OK Thanks for the information. We will announce this incident on our blog and your data will be uploaded there as well.