Ransomware negotiation(s) with
hunters
Hi, how may I assist you?
Saturday, 19:40
That is an extremely high demand. To consider any payment we need to know what you have and what you did. It looks like I can upload encrypted files to test your decryptor?
19:46
Yes, you can. We will decrypt. The data will be available later.
19:47
Do you know how much data you have?
21:14
I think you provided a file listing? Looks like just 2.7 million files? Just want to be sure I have the right number to report
Sunday, 3:58
That is correct. We have 2,793,643 files 2.3 TB in total.
5:04
Ok that's good to know. It's not everything but it is a lot. We are analyzing it now and will have a request for a few files so you can prove you have them and not just a file tree. I also have a team working on getting encrypted files. This has proved difficult so please be patient
13:34
Files uploaded for proof of decryptor
15:52
The files have been decrypted.
16:11
Thank you. Updating
16:14
My executives want me to make you aware that we have been through this before. We were ransomwared a few years ago, and similar to you they asked for a ridiculous amount of money. We did not pay them. Their loss puts you at an advantage though. We did buy Bitcoin then for the potential situation we are in right now. My boss does not want to waste money or time on this any longer and is willing to pay you that Bitcoin so we can all walk away today. As you know banks are closed today and tomorrow due to holiday, so we only have what Bitcoin we have to work with. We can send you $1,500,000 within hours. Accept and we will start the process of cold storage removal
18:26
We have a majority of the Bitcoin ready. Did you take today off for easter? The longer this takes the less valuable payment becomes
Monday, 0:28
We are ready to take nothing if it's what you meant. The price is final. It is only your decision to pay or be disclosed.
We do discounts only for small companies.
4:19
In the last ransomware case we walked away from a lower demand. You currently can have $1.5 million ready to be in your hands. Our bank is closed so we can only work with the bitcoin we have from the last incident, which is less than your demand. Additionally if this goes much longer, my executives may change their mind and just rebuild. Please make a reasonable offer
14:32
We are not in a hurry. We will wait for your bank to be opened.
And please stop appealing to your last ransomware case. We are not them and each case is unique, especially when you are dealing with us.
14:51
We appreciate your patience but we will not be paying $10 million. The longer this goes on the more likely you get nothing. You don't have everything and our rebuilding teams are being activated. Please provide a reasonable offer and I will push to get approved.
It is good for you to know our experience so you can make an educated decision to work together to come to a reasonable conclusion. Our executives have walked away before. We are prepared to pay you a great deal of money for quick resolution but not as much as you are asking
15:49
I'm okay to get nothing. Just tell me that you will not pay us $10M and I will publish all of your data on our data leak site right away.
I also would like to point you out that we will send a bulk email to your competitors, partners and customers, informing them about the incident with proofs attached.
19:32
Let’s reset and try to work together on this. Clearly $1.5mm is not enough and $10 is too high. How do we come up with something in between? I think everyone wants to move quickly to finish this on good terms
21:51
The only way for you to resolve this is to pay the full amount.
Tuesday, 5:18
Our IT team is rebuilding and having success. Soon there is no need to continue this conversation. We will not pay you $10mm. We are willing to resolve this today for $4,000,000.
14:36
Okay, so you are ready for your data will be published?
We don't need $4M or even $9M. Stop wasting your time.
I hope you already checked our data leak site so you can see there are some huge companies with all sensitive data published. You are not an exception.
14:44
This information is provided by Valéry Marchive & Julien Mousqueton