Ransomware negotiation(s) with  revil



Avatar

Good evening Sir/Madam. I'm [redacted], and I was asked by the [redacted]'s executives to assist them in completing a business arrangement with you. I'm neither a technological expert nor a lawyer. I have a financial background and currently work in the public sector here in the [redacted]. As you probably understand, we would like to complete this unfortunate event as swift and clean as possible. Kindly let me know how should I call you and when should I expect your reply. Respectfully, [redacted].

14 days ago

Hello, our communication is conducted only through this chat. We are ready to listen to your proposal.

14 days ago
Avatar
Avatar

Thank you Sir/Madam. I have no idea what kind of proposal I should make to you. We are an [redacted] charity run by [redacted]. We get money, public funds, and I have no experience in this occurrence. We are not a business. I understand that we need to pay a certain amount in order to get our systems back to full operation. Am I right? Respectfully, [redacted]

14 days ago

Yes, you are right, for our part we want to see the best deal that you can afford.

14 days ago
Avatar
Avatar

Sir/Madam, do you mean what is the amount we can pay in order to restore our systems? Respectfully, [redacted]

14 days ago
Avatar

Sir/Madam, do you mean what is the amount we can pay in order to restore our systems? Respectfully, [redacted]

14 days ago

Yes of course.

14 days ago
Avatar
Avatar

Sorry Sir/Madam, for sending twice. I'm a bit overwhelmed by stress and this experience.

14 days ago

No problem.

14 days ago
Avatar
Avatar

Sir/Madam, I honestly don't know. I see that you request 4 Million USD which is almost 3M GBP. We will never be able to pay this amount. Should I now tell you how much we are willing to pay? Is this what you mean? My apologies to be very cautious. I don't want any mistake to happen here. It is the future of 50,000 pupils. Young kids. Respectfully, [redacted]

14 days ago

We understand this, but still we do not expect a low offer from you.

14 days ago
Avatar
Avatar

Sir/Madam, I understand. Please allow me to consult. Respectfully, [redacted]

14 days ago

We wait.

14 days ago
Avatar

We are not in the mood for a long conversation, so we look forward to hearing from you shortly.

13 days ago
Avatar
Avatar

Sir/Madam, I'm here and after intense conversations and internal consultations as you might imagine. Please refrain from hostile language. I will appreciate it. I was instruct to further elaborate with you couple of points, obviously after I did my own research about you and your highly professional capability and status.

13 days ago

Well, we are ready to listen to your questions.

13 days ago
Avatar
Avatar

Thanks Sir/Madam. I appreciate that. (1) What type of information will you provide upon completing the deal? (2) What type of information are you currently possessing? (3) How can I guarantee that data will not be further monetized upon completion of our deal? Thanks much in advance. [redacted]

13 days ago

We value our reputation and we have proved ourselves over a long period of time. We have a 100% guarantee after the transaction is completed that you will receive the decryptor and your data and information about you will be immediately deleted.

13 days ago
Avatar

Also, after payment, we will conduct a full audit of your network in order to avoid subsequent hacks.

13 days ago
Avatar
Avatar

Thanks Sir. I will convey this and revert shortly. Respectfully, Emilie

13 days ago
Avatar

Thank you Sir. I believe that the last offer will not be required, however, I will be extremely thankful if you could at least tell me what information you have in your possession. I believe that this information is of utmost importance to determine the amount the charity will pay. Respectfully, [redacted]

13 days ago
Avatar

Sir, I could not red your last message. Was it deleted deliberately? Respectfully, [redacted]

13 days ago
Avatar

My apologies for typo. I meant "read".

13 days ago

We have information about all your financial transactions, the details of your partners, card numbers and much more. We never conduct a full check of the information we have.But for example : [redacted] [redacted] [redacted] [redacted] [redacted]

13 days ago
Avatar

Sorry for the failed submission last time.

13 days ago
Avatar
Avatar

Thank you Sir. I understand that. Mistakes happen at all times. We are all humans. I will forward your reply. What does this mean: [redacted] [redacted] [redacted] [redacted] [redacted] Is this a file? or a directory? I want to ask you in order not to look unprofessional in the eyes of my colleagues. Respectfully, [redacted]

13 days ago

These are lines from your documents.

13 days ago
Avatar
Avatar

Sir, does it suppose to mean anything of importance? Respectfully, [redacted]

13 days ago

If you think the card details of their owners are important, then yes, they are.

13 days ago
Avatar
Avatar

Sir, you mean Credit Card details of the Charity owners? Is this what you have in your possession? I'm asking again in order not to cause any confusion, and the guarantee an decision making process which is based on accurate data. Thanks, [redacted]

13 days ago

No, I mean the credit card details of your clients or employees.

13 days ago
Avatar
Avatar

Ohh, I understand. Thank you. I'll revert, hopefully tonight. Respectfully, [redacted].

13 days ago

I hope you understand that this is just an example of what we have.

13 days ago
Avatar
Avatar

Yes Sir. I do understand. And I'm confident enough in your wisdom to present me with an attractive information, in order to present your most valuable assets. Credit card information of employees is probably the most attractive asset. Respectfully, [redacted]

13 days ago

I would like to remind you that we are not ready to drag out negotiations. In case of waiting for long answers, there can be no question of any discounts from our side.

13 days ago
Avatar
Avatar

Sir, I'm aware of that. I will present a significant amount in my early AM tomorrow. The relevant decision makers are currently consulting. Thanks for your understanding. Respectfully, [redacted]

13 days ago
Avatar

Good morning Sir.. Your TOR website is offline for quite some time now. Is it ok to continue using this platform? Respectfully. [redacted]

12 days ago
Avatar

I got the mandate to make you an offer. Please let me know if it's ok to make it now?

12 days ago

Yes we are listening to you.

12 days ago
Avatar
Avatar

Thanks Sir. We can pay 750,000 USD in XMR, provided that you will share with me the exact scope, volume, and significance of data that is in your possession. I would like to stress that this amount is far beyond what we understand is usually charged by your teams (based on recent news reports. I've turned to be an expert on your business in the last 3 days, Fortunately or unfortunately.) I do stress the data, rather than the decryption key, since I learned about your very positive reputation in providing decryption keys. Looking forward hearing your thoughts. Respectfully, [redacted].

12 days ago

You are asking for a huge discount. But my boss is ready to take a step forward. Our offer $ 3kk.

12 days ago
Avatar
Avatar

Sorry, you mean 3 Million USD?

12 days ago

Yes that's right.

12 days ago
Avatar
Avatar

Oh God. No, this is so far of what we can pay. Please hold and I'll report to my colleagues and revert. Respectfully, [redacted].

12 days ago
Avatar

Sir, we will not be able to pay that amount. Please advise. Respectfully, [redacted]

12 days ago

This amount was formed after a detailed audit of your company and it fully corresponds to your level and size of your company.

12 days ago
Avatar

You can make another suggestion, and we will consider it, but we are not expect small money from you.

12 days ago
Avatar
Avatar

Sir, thank you for this frank answer. Your "client", my colleagues, are not a company, and it seems that your reply is of a general nature. We are a charity fund, [redacted] non-profit, and our resources are all public resources. I will be able to come back to my colleagues, once you provided me with any information which will make them re-evaluate their decision. One of your colleagues, in a recent interview, said that you don't like to bargain. So please, I'll appreciate if you will find me as a genuine partner with whom you share information in order to craft a deal which works for both of us. Respectfully, [redacted].

12 days ago

Publication of your information will create damage much more valuable than our requirements. Think about it, you have the minimal price and we usually don't negotiate about it.

12 days ago
Avatar

If you pay soon, we are ready to make an additional discount.

12 days ago
Avatar
Avatar

Thank you Sir. I appreciate your advise, however this can't be cosidered a valuable advise. I will need to understand the percularities of what you wrote above: (1) Publication of which information? (2) What do you mean soon? (even if we agree tomorrow, it will take 3-4 days of official approval and execution) and (3) what is the additional discount? Thank you for understanding, and I really grateful for your willingness to assist. Respectfully, [redacted]

12 days ago

We are talking about publishing information that we have downloaded. If you pay before Saturday, we will give an extra 20% discount.

12 days ago
Avatar
Avatar

Sir, your proposal set the price tag for publishing unknown information on 2.4M USD. I see no scenario that the charity board and trustees will approve this by tomorrow, in order to be executed by Saturday. Sir, if you want to take advantage of my expreienced services in deal making you will have to allow me (1) details of information you have, as this and the decryption keys are the corner stone of any decision which will be taken, and (2) set a reasonable price for a non-profit charity around 800-900K, to be paid at some point next week. I'll be here, throughout this process, to make sure that we are progressing as planned. Respectfully, [redacted].

12 days ago

I provide you additional proofs below and recommend you hurry up with decision, because payment procedure can takes time. If you don't pay, your files will be published to the blog and shared to media, other data will be sold. Anyway it will influence to your reputation, think about your customers and fines and other troubles waiting for you. We offer you solution to avoid everything of this.

12 days ago
Avatar

This is an example of files that we downloaded. All files you will receive after payment.

12 days ago
Avatar
Avatar

Good morning Sir. My sincere apologies for not replying last night. I was cought up at another event. I will forward this information to the relevant people and contact you back later during the day. I thank you for all the assistnce you provide in order to terminate this unpleasent affair. Respectfully, [redacted].

11 days ago

Hello, ok.

11 days ago
Avatar
Avatar

Sir, are you one person or few people rotating in shifts. Asking because you are always available, and always accesible. And are you the one who can finalize a deal or you need any approval from higher level? Respectfully, [redacted]

11 days ago

I have a boss

11 days ago
Avatar
Avatar

Thanks. Ok. I working on our case in the next couple of hours. Will revert as soon as I have information. Respectfully, [redacted].

11 days ago

Okay we wait.

11 days ago
Avatar
Avatar

Sir, one of the trustees of the charity have asked me in private what are the chances of bringing the price down to 900K USD? He shared with me her internal conversations and her belief, like you and me, that a deal is better than any publication. However, she said, reviewing the information you sent will not convice the relevant people to pay that amount of many. It's about "risk management" she said. Decryption keys and that information should cost around 1M. What would be your answer to her? Please keep in mind that she is sharing her thoughts with me in private and I'm not that sure that she represents any majority. Please consult with the boss and let me know? Respectfully, [redacted]

11 days ago
Avatar

I'll be back to this computer in 2-3 hours, Sir. Thanks. [redacted]

11 days ago

We need to discuss this with the superiors.Wait for answer.

11 days ago
Avatar

My boss is ready to give you a discount. $ 1.5 million is our latest offer.

11 days ago
Avatar

Let me remind you that this offer is valid only in case of quick payment.

11 days ago
Avatar
Avatar

Sir, I'm thrilled. Thanks a lot. I'll convey this in my meeting with board and trustees in the morning. First time in last days that I'm going to bed with a smile. I'll contact you for further communication and updates in the morning. Best regards, [redacted]

11 days ago

We wait.

11 days ago
Avatar
Avatar

Good morning Sir. Board and trustees of the charity will convene in 1.5 hours. I'm in direct contact, as I shared with you yesterday with one of the trustees, and she will update me immedietly after the meeting, even before the official statement. Respectfully, [redacted]

10 days ago

Okay.

10 days ago
Avatar

We wait.

10 days ago
Avatar
Avatar

Sir, may I ask you a direct question? It's important that you will be completely honest with me, and if you don't know the answer, I would appreciate if you could check with the boss. Are you still interfering with our systems? Do you do any actions related to our employees? Awaiting your answer, [redacted]

10 days ago

We provide this information only after payment along with the audit of your network.

10 days ago
Avatar

I remind you once again that all our agreements are valid only in case of quick payment. It seems to us that you are deliberately delaying the dialogue.

10 days ago
Avatar
Avatar

Sir, I wish I could have brought you into the trustees meeting. In the middle of meeting when they discuss paying your suggested price, came this notice of your continued efforts to sabotage the charity network. With all due respect, Sir, do you think it was necessary? Do you think it was helpful? I'm doing a tremendous effort to show everyone your nice, welcoming and human face, and you keep on your evil moves? How should I show my face now? I guess that you haven't understood that you and me are working together to bring this deal? You have to assist me, not work against me..!

10 days ago

We never commit malicious acts while communicating. These words are confirmed by our reputation.

10 days ago
Avatar
Avatar

Are you completely confident about that Sir? I'ts not only your reputation here, it's mine as well. Thanks, [redacted]

10 days ago

We are sure. You have nothing to worry about.

10 days ago
Avatar
Avatar

Ok. I trust on that. I'll further communicate tonight. I need to go back, with this information, to do some damage control, and it starts to be late into the weekend. I'll come back later this evening. Respectfully, [redacted].

10 days ago

Today we are waiting for the results of your negotiations from you.

10 days ago
Avatar
Avatar

Good evening Sir, as I predicted on Wednesday or Thursday (sorry, last week was like crazy hell for me, very little sleep, very stressful, and almost no time for my young kids), the charity's leaderhip could not make a decision before the weekend. As predicted they asked me to ask you to delay reply until after the weekend (Monday afternoon), as well as to seek, if possible, additional discount to 1M. I told them, bluntly, that I'm not sure about additional discount, becasue from what I understood from you, what your boss already approved was beyond the ususal discount you give. I left board meeting really frustrated, first of all on a personal level, due to the fact that I thought I will have a quite weekend, handing over our correspondance to the person who will take care of execution and buying the XMR, but also because I have no face to disspoint you. I know that you expect an answer, and I feel bad that I can't deliver any positive results at the moment. I need to ask you for an extension. I'll be here to reply to all your notes, to provide you with any background information you need, and even if you want to exchange weekend receipies. Board and trustees will reconvene after the weekend, on Monday morning, and on the positive side, it gives me time to talk and to be successful in persuading them to complete the deal in order to recover all systems by Tuesady/Wednesdy. Thanks in advance for you understandging. I really appreciate it. Respectfully, [redacted].

10 days ago

We have provided the maximum possible discount in your case. On Monday night, we will no longer be able to talk about any concessions, as the ransom amount will double.

10 days ago
Avatar
Avatar

Thank a lot, Sir, for understanding. I will be in close touch also during the weekend. Best and have good night. Tell your boss that you deserve some time off and a good drink. Emilie

10 days ago
Avatar

Please also update the countdown of the clock at the bottom of our corresponding page? Thanks, Emilie.

10 days ago

Your time runs exactly to the one indicated by me above.

10 days ago
Avatar
Avatar

Ok, maybe I'm a bit confused. I trust you. Good night Sir.

10 days ago

Okay.

10 days ago
Avatar
Avatar

Good evening Sir. I hope that you took some time off to be with your family. I'm here to answer any question. Respectfully, [redacted].

9 days ago
Avatar

Good evening Sir. The IT team have sent me a file, which they kindly ask you to decrypt in order to see, as mentioned in your early note and here on this website, the the decryption tool actually work. I will try to attach it now. Respectfully, [redacted].

8 days ago

Hello

8 days ago
Avatar
Avatar

Good morning Sir, I could not sleep the whole night. Thanks for the file, I'll be in touch later this morning. Thanks, [redacted].

7 days ago
Avatar

This was written couple of hours ago, but apparently there was a fault in your system and it was sent just now.

7 days ago

Okay , we wait.

7 days ago
Avatar
Avatar

Thanks, I'm here. I would like to ask you, first, informally (before I speak to "my" trustee in the board). Is there any chance that you will be able to extend the deadline for Wednesday evening? The reason I'm asking is because there was some government move to our senior leadership, and I'm afraid that they were asked not to pay. I can tell you that the majority of board members want to complete the deal, as it's the only way they can restore the system, but it seems that the weekend brought with it also pressure in the opposite direction. Would love to hear your boss opinion on that. Respectfully, [redacted]

7 days ago

We are not ready to stretch the time like that. All my boss is willing to offer is Tuesday night, if payment is received by then.

7 days ago
Avatar

If your senior management is unwilling to pay, we will start publishing information, be sure to remind them of this.

7 days ago
Avatar
Avatar

This is why I'm checking with you Sir. The board of the charity is meeting in 1:30 hours, (2 PM GMT), and I want to bring them the most updated information from you. At the moment, you were kindly offering the charity to pay 1.5M and deadline is tonight. If I could get an extra "stretch" (as you wrote) to pay 1M, and deadline is Wednesday morning, that would have been very helpful to get the board and trustees approval, despite any other external voices. Please bring it to the boss approval. Anything of this will make my mission more likely to succeed. Thanks in advance, [redacted].

7 days ago

We have already given you time to discuss these issues at your meeting today. My boss isn't ready to give you time until Wednesday.

7 days ago
Avatar
Avatar

I understand. May I speak with the boss? Can he come to the chat? Can I give him an email address?

7 days ago

All conversations are conducted through this chat, and all messages are sent to it. We gave you a good discount and enough time to resolve internal issues. It's all.

7 days ago
Avatar
Avatar

Please, you can't leave me with this answer. I see that boss can't do Wednesday, and I understand his and your perspective. Will it be possible to leave price as it is, and give time decision time until Tuesday night? If it was not this external inputs, I'm confident that I could have sort it out by myself. Thanks, [redacted]

7 days ago
Avatar

Please reply Sir, I'll be back in an hour. Need to go and prepare for board meeting. A women, you know.

7 days ago

Our agreement is valid until Monday night, I have nothing more to add for you. The discount is provided for quick payment.

7 days ago
Avatar
Avatar

I see, Sir. I can't ask more, and I don't beg. If you can extend the deadline until Tuesday - it will be helpful with the board in 5 minuets. If you are not interested - I will not be happy with it, as it will be more difficult for me to persuade board and trustees to complete the deal, but - I will understand. As said, I'm a woman who respects herself and her partners. I will not beg. Respectfully, [redacted]

7 days ago

An article in our blog will be prepared tonight (not published at the moment). Perhaps this way your bosses will want to pay faster.

7 days ago
Avatar

My boss is willing to allow until Wednesday, but in this case, discounts are out of the question.

7 days ago
Avatar
Avatar

So Sir, what are my option, currently??

7 days ago
Avatar

My options, I mean. 1.5M until tonight or 2.4M until Wednesday? Or can you do 1.5M until Tuesday 2PM GMT? Best, Emilie

7 days ago

This is the last thing we can offer on Tuesday, 14:00 GMT. If you do not pay, the data will start to be published.

7 days ago
Avatar
Avatar

Thanks Sir. I appreciate it. A lot. Please convey my thanks to your boss. Respectfully, Emilie.

7 days ago

We wait.

7 days ago
Avatar

http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/[redacted]?s=[redacted] (Use TOR browser) This is just a small part of what is being prepared for publication. At the moment, this blog is only visible to you. We hope your boss is ready to resolve this issue soon.

7 days ago
Avatar
Avatar

Good morning, Sir. I see. Thanks for sharing. I'll revert soon. Emilie

7 days ago

You don't have much time.

6 days ago
Avatar
Avatar

I know Sir. I can't ask for more time. There is no decision yet, on behalf of the board and the trustees. The situation has turned to be too complex, and I hope that a positive decision will be taken in the next couple of hours. I predicted that, and this is the reason for asking for the Wednesday deadline, however I fully understand your view point. I'll come back once I have news. Respectfully, [redacted].

6 days ago

We wait.

6 days ago
Avatar

Today we have not received a clear answer from you. Your data will be ready for publication shortly. We still suggest that you solve this problem.

6 days ago
Avatar
Avatar

Sir, I have no news. I wish I could solve this matter. I wish. I predicted the dynamics in the charity, this is why I asked for Wednesday, and 1M. There is nothing I can do now, apart from praying that your boss will give me more time. But if it puts you, personally, at risk, please don't ask. Yours, [redacted].

6 days ago

My boss is asking you a specific question. Are you ready to pay on Wednesday or continue unnecessary conversations with us?

6 days ago
Avatar
Avatar

Sir, I want to be honest. I don't know now. I just don't know what the decision will be. They are discussing, elaborating, trying to find understanding and sources of fund to pay. It is completely your decision Sir. I can't ask for more. You were very generous, and I hope one day will come I could reciprocate. [redacted].

6 days ago

We think it's worth starting publishing to make your bosses more accommodating.

6 days ago
Avatar
Avatar

As said, it's your call. You are more experienced than me in this business, and I'm familiar with the decision making process here. Publication will most likely discourage charity's leadership to pay anything. But again, you have the finger on the control button. Hope you'll take the right one. [redacted].

6 days ago

What time is your meeting tomorrow?

6 days ago
Avatar
Avatar

Starts at 14:00 London time. Sir.

6 days ago

How long will they take?

6 days ago
Avatar
Avatar

Hope to have an answer by 17:00 GMT. If not a definitive answer, at least a positive indication, Sir.

6 days ago

What do you mean by "positive indication" ? Another meeting on Thursday ? Or preparing for payment ?

6 days ago
Avatar
Avatar

I guess the latter Sir. This will not be dragged by Thursday, I believe.

6 days ago

Wait for answer.

6 days ago
Avatar
Avatar

Im here Sir. Waiting for you.

6 days ago
Avatar

I'll check your decision in couple of hours Sir. I must leave this computer and go home to my family. Respectfully, [redacted].

6 days ago

We spoke with the boss for a long time about the current situation. If we receive the same response tomorrow as today, the attacks on your network will continue and the data will begin to be published. That's all we have to offer at the moment. Also, in addition to the time, we extend the amount agreed by us.We need to know if you have informed your management about the current publication?

6 days ago
Avatar

Time added. Price update.

6 days ago
Avatar
Avatar

Sir, I thank you and your boss, however I'm a bit confused by your message. First, my colleagues are informed on all our communication. I understand about the publication, and the sample publication you sent me earlier is what stirred the debate among the trustees, as I predicted. Second, what do you mean the attack will continue? Is this kind of a terminology you use to persuade people? Thanks for understanding, [redacted].

6 days ago

Continued attacks only in case of refusal to pay, of course. If we find a common language, we can help you close all vulnerabilities and prevent future hacks.

6 days ago
Avatar
Avatar

So, am I right to understand that you still have assets and access to the network? If yes, I need to inform the leadership as this change their discussions tomorrow. What type of access you have? Thanks, [redacted].

6 days ago

Such information is provided only after payment.

6 days ago
Avatar
Avatar

Yes. I thought that this will be your answer. I'm too exhausted to comment. Thanks and have a good night. [redacted].

6 days ago

We wait.

6 days ago
Avatar

Any news ?

5 days ago
Avatar
Avatar

Sir, good evening. No news. Significant and powerful external forces are involved at the moment. No decision has been made. I don't know to say when. I'm asking for nothing. Just humbly informing you of the current state of affairs. Sorry for that. [redacted].

5 days ago

It seems like it's just your choice.

5 days ago
Avatar
Avatar

Not mine, Sir. I'm doing my best. [redacted].

5 days ago

If during the day my boss does not receive a response from you, attacks on your network will continue, I hope your management will be pleasantly surprised.

5 days ago
Avatar
Avatar

I will pass this message Sir.

5 days ago

Why did you make your suggestions before, but now you cannot understand what is happening ?

5 days ago
Avatar

After this timer expires, the data will be published in the blog and transmitted to the media. dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/[redacted]?s=[redacted] (Use TOR browser)

5 days ago
Avatar
Avatar

Good morning Sir. I understand very well what is happening. And I probably failed to explain what was going on at the board meetings. [redacted] charity is not a private company, many stakeholders involved. Unfortunately. [redacted].

4 days ago

Express your leadership's decision.

4 days ago
Avatar

How much are you willing to pay in the near future?

4 days ago
Avatar

You have 30 minutes left until posting. Don't you give a damn about a personal data leak?

4 days ago
Avatar

This post will only be the first part. The next one will contain information about your students and investors.

4 days ago
Avatar

Soon we will start publishing all personal data of your students.

3 days ago
Avatar

[redacted] won't help you

3 days ago
Avatar

The first part of the data is being prepared for publication soon, if you have a proposal for payment, my boss is ready to listen.

2 days ago
Avatar

We wait your answer.

17 hours ago
Avatar

This information is provided by Valéry Marchive