Ransomware negotiation(s) with
akira
This is [redacted]. You did not reply to my emails for a long time
We have responded that we can communicate in this chat only. It is secured.
I explained TOR is not permitted on our IT systems. This is a private device.
These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back.
We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.
We will download examine the files to verify they all belong to us. This might take longer than 24 hours as our IT team is very busy. Please be very patient with us.
[redacted].log.akira // 1.02 MB
[redacted].ps1.akira // 255 KB
[redacted].log.akira // 1.02 MB
[redacted].vmcx.akira // 77.8 KB
[redacted].vhdx.mrt.akira // 77.8 KB
Here are some files to prove you can decrypt our data.
If you annouce our name or release any data on any blog. There will not be any deal.
Please wait for the files.
You can review the files.
We are only interested in decryption. What price for that? As a small local firm we are not having a good year and our available funds are very small. It will take us weeks because our cashflow is very tight. We do many cases for charity and to support children with life-limiting conditions. You will have seen this in our files. If you take our money, we can only give less to our charities. Please remember this when you talk about a price.
We still need to test the decryption files but IT has gone home for today.
You will get the price shortly.
So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $2,000,000 price for ALL the services we offer:
1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Dear Sirs, We acknowledge your request and the amount, but we are sad to say that is simply much too high a number for us to deliver on. We are not a big law firm. Your attack has damaged our company and upset all our staff. We care about our staff and clients and we are a small family law firm, which does much work for charity. We particularly raise funds for very sick children. Whatever we could pay would reduce the amount we can give to charity. Also, if we move a large amount our banks will be suspicious and will lock down our accounts. This would also mean you get zero. We do wish to resolve this, but ask that you are more realistic and demonstrate good judgement on lower number. We ask you for credit as we contacted you early. We do not play games or waste your time. We only want to decrypt our files and save our family business. Please show us a good discount and tell us how to pay? [redacted]
Hello. We're well aware of the industry you operate in. It doesn't matter, fortunately or not. We've heard these stories so many times. We're willing to take a step towards you and come down to $1,7M USD. Our patience has a limit, so you better speed things up and we will get you back on track immediately. Any further complications can lead to your data disclosure as well as decryption keys deleting. We will wait for 24 hours more and if there are no progress, we will delete this chat. We're not interested in long dialogues.
Dear Sirs, we acknowledge and value the discount you have offered. We will discuss and come back to you. It might take us longer than 24 hours, so please be patient. If you leak / publish our data, there will be no deal. [redacted].
Dear Sirs, we reply to you in good time and thank you for your patience. We are taking this matter extremely seriously but we have never faced this kind of issue before and we hope you understand from your previous experiences and great skills that we cannot pay within 24 hours, but we do wish to resolve this with you. Please understand the time we need. We can prove we do much for charity to help children in our world: [redacted]. We tell you the truth and here is proof. We do not have enough funds available to meet your request, but we can make you a very generous payment of USD$900,000 in exchange for the decrption of our data. There is a big risk for you that a larger payment would alert our bank and their regulations would mean our account would be frozen for weeks whilst they investigate. This would mean major delays, maybe zero for you and no decryption for us. Is this what you want? Please accept our generous and sensible offer and share your BTC wallet so we can begin to move funds and make the payment. We will never deal if you leak any of our data or mention our company on any blog. [redacted]
Well, the bosses appreciate your offer as well as your willingness to get this over with us. We're well aware of how payments work. Your transfer won't be frozen if you refer to any local broker who can facilitate the transfer. Anyway, my bosses has agreed to take a final step and come down to $1,500,000. We can even suggest you to split this into two payments. Here is our BTC wallet ID for payment: [redacted]
We note your reduction in demand and we will come back as soon as we can with news. [redacted]
Dear Sirs, we are still considering your previous offer. Can you recommend / suggest a BTC exchanger for a company such as ours. Finding this service is difficult. [redacted]
To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin
https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. Once we get payment, we will provide the decryptors for each of your systems immediately.
Hello. If we don't receive payment tomorrow, we will have to publish your data. Let it be 6pm SG time.
Hello. Any news? Should we announce the incident on our blog?
Dear Sirs, We are very sorry for the delay. We explained we are in the process of arranging the transfer. We cannot make a payment of $1.5m as this is too much for us to transfer without triggering security rules and a lockdown on our accounts. We are told by our finance dept that we can transfer a maximum of $1,075,995 without triggering security restrictions. We have tried all options but cannot make a payment to you until next week. Next week we can pay. Would you accept $1,075,995 in these circumstances? This is safer for you and us. We wil pay in two stages once we have safely obtained your funds. Do not publish our name or date or the deal is off. [redacted]
The bosses told you the amount we will accept. Don't test our patience if you don't want a demand increase. We are willing give you more time but no further discount. We know your value. Pay on Monday or we publish your data on our blog. No more stalling.
Dear Sirs, we are grateful for you and your boss's patience. We must avoid any increase. Do not publish our data. As I said before, we are new to making crypto payments and it is taking more time that we want, but we do intend to pay and resolve this. We are making progress but no certainty on which day and which time. We are grateful for your understanding and I will update you on what day we can begin the transfer to your account. Let me update you on Monday next week on the exact payment date and how much we can transfer. No deal if you choose to publish. [redacted].
Dear Sirs, We thank you for your patience. We are actively trying to secure BTC to make a payment to you and resolve this matter. We are new to BTC and this is taking longer than we anticipated, due to the size of the payment and security questions from our bank. We must avoid our accounts being frozen at all costs. We will come back to you with a time estimate for making a payment as soon as possible and keep you updated. [redacted]
It has been more than a week. I believe we will have to publish your data this week if we don't receive payment.
Dear Sirs, we are moving towards payment as quickly as we can. We want to resolve this and unlock our files. Please show patience and good judgement as you are dealing with a company which has never bought large BTC before. We are learning and progressing. Do not publish anything and we will conclude this as soon as we can. [redacted]
We're standing by. Keep us posted on a daily basis please.
Dear Sirs, we are in the final stages of making the arrangements to make a payment. We value your understanding and patience whilst we make sure this can be resolved without risk to you from the banks closing our accounts. Before we can agree a final value, what assurances and guarantees can you give me that our data, files, file names or company name has not already been sold or leaked by Akira or your colleagues? This is a most important element to us. [redacted]
We value our reputation and honor all agreements made. You will not find a single case where we have broken an agreement or failed to fulfill any of the clauses.
We are the ones who can properly decrypt your data and restore your infrastructure in a short period of time.
After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. You will be able to restore your infrastructure within 24 hours. If you face any problems during decryption process, we will be here to support.
You will receive a deletion log which means the raid drives that contained the only copy of your data are fully formatted and erased.
You will receive a security report that includes information about how we were able to penetrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure.
You will also receive written guarantees that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again.
Are we waiting for a $1,5M transfer, right?
Dear Sirs, We are grateful for your reassurances no data has been leaked and you believe in honor and reputation. We wish to conclude this and hope we can agree a price. Please remember that we only asked for part of your service (1) Destruction of our data you hold (2) Sharing of working decryption keys to restore our systems. What is your best and final price for this. We have not caused you any frustrations and hope your bosses can give us a discount in these circumstances. Be realistic with us and let's agree a final amount of $1,240,799 and we shake on this today. Please accept this offer and let's both move on. [redacted]
Well, we had an internal discussion as a result of which the senior leaders have agreed to come down to $1,400,000 to get this over with finally. We have provided you with $600,000 discount as a total which seems to be fair. We can't go any lower from this point. We haven't put any pressure on you during negotiations, we haven't leaked your data or disclosed the details of this incident. Let's finish this today. The wallet is still the same: [redacted]
Note that this price is only valid today. Tomorrow we will have to go back to a demand of $1.5 million. Let's not complicate things.
Dear Sirs, this is a very large amount for us and we cannot go any higher under any circumstances. We can agree USD$1,400,000. We would like to make payment today and want to agree a BTC amount at the current price as we cannot transfer more. Can you agree 21.02BTC total? If so, we can begin with a $1000 test payment. Do you agree? [redacted]
We can agree 21.07 BTC total. Waiting for a test payment.
Dear Sirs, we agree a price of 21.07BTC and will send an initial test payment of $1000 now. Once you acknowledge successful receipt, we will send 50% of the payment and await your evidence that our data has been completely deleted. When we have that proof, we will authorise payment of the remaining amount, totalling 21.07BTC. We then expect to receive the decryption key and your assistance if needed to recover our files. [redacted]
We do confirm the terms. Waiting for a test.
0.01477521 BTC received. You can proceed with the first part.
Thank you for confirming. We will send the next payment now. [redacted]
Standing by. Preparing the proof of deletion now.
We have received the first part. Sending the proof of deletion now.
[redacted]_log_del.zip // 3.06 MB
Please, see the proof of deletion above. We're waiting for the rest part.
Thank you . We are examining the file. Please wait
Dear Sirs, We have sent the final payment and await you to complete the agreement. Please send decryption keys to unlock our files and systems. [redacted]
We have received the final payment, thank you.
unlocker.exe -p="path_to_unlock"
unlocker.exe -s="C:\paths.txt"
where "paths.txt" is a list of paths for the decryptor, each path on a new line
ESXi commands
1) chmod +x unlocker
2) ./unlocker -p="/vmfs/volumes"
This information is provided by Valéry Marchive
