We are REvil Group. We want to inform that your company local network have been hacked and encrypted. We have all your local network data. The Price to unlock is $2,500,000. Now we're keeping it a secret, but if you do not reply us within 7 days it will be posted on our news-site. Think about the financial damage to your stock price from this publication. In case of successful negotiations we guarantee that you will get decryptors for all your machines, non recoverable removal of downloaded data and security report on how you were hacked to fix your vulnerabilities. We hope that you can correctly assess the risks for your company.

You can use Bitcoin instead of Monero, but it will be more expensive for you in case of our merchant additional fee, so if u want to pay in BTC u need to add +10%. Btc enabled

It will take us a little time to collect the necessary data. Timer updated

https://privatlab.com/s/v/[redacted] password for download: [redacted] password for archive: [redacted]

So that you understand what data we have http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/[redacted]?s=[redacted]

(Use TOR browser)

Hi, all my boss has to offer is a 10% discount. We know the scale of this company's problems. Such low amounts are not even considered

To solve your problem, you need to increase your offer by at least 10-fold.

My boss is not interested in this amount. You have a few days before publishing in the blog and in the media

Friend, you shouldn't start this game, we know very well how much damage has been done to your client. If it was insignificant, you would not write here. If you have nothing more to offer, we have nothing to talk about

As we said earlier. Your proposal is not interesting

It doesn't matter for us whether you need decoders or not, for us this is not an argument, one way or another you will get them

We have voiced our proposal to you earlier if you cannot approach it then there is no point in continuing the dialogue

We are ready to consider the issue of the discount again, but what you are offering sounds silly.

I have nothing more to add data will be sold and you must understand this

If this data is useless, what are you doing here? If you have nothing to pay so much for, then why are you discussing the price? Either make an offer that will interest my boss, or the publication will be in 19 hours and the "dancing" will end.

Not interested

You shouldn't use the old tricks. Leave your email with you

I must say right away that the amount is less than 1kk my boss is not interested

If you agree, we close the publication and continue cooperation if not. I think you yourself know

Okay my boss agree price update you can pay.

ok

Um no. You said that your client does not need a universal decoder, so we will not provide one. We confirm everything else

The price is formed solely on the fact that you need to completely delete the data and everything from points 2-6. For a decryptor, the payment will be much higher.

Hello , are you ready to pay ?

wait for answer

Hello we deleted all information about company

1. Administrators must work in browsers in in-private mode 2. Administrators are prohibited from saving passwords in browsers 3. Administrators are prohibited from saving files with password lists on their computers or shared resources, as well as sending them by e-mail 4. All users are forbidden to open suspicious mail, punish with money. Allocate for this one computer without connection to the corporate network 5. Administrators work in virtual machines. Virtual machines must be in cryptocontainers 6. Configure firewalls so that administrator's computers do not have direct access to critical servers, but virtual machines have it (firewall rules and network ranges) 7. Limit the list of domain administrators. Split domain administrator password between security department and administration department (password is very long) 8. Delegate small roles to administrators for daily work (resetting passwords, creating users) 9. Use strong antivirus, Cylaence or Сarbon Black or Cortex (we do not advertise antivirus, think byr yourself) 10. Limit access to the Internet on servers and admin's computers. Create a terminal server in the DMZ and use the terminal browser applications 11. All suspicious letters with links should be sent to the IT department for verification on a stand alone virtual machine. 12. Configure mail filters to work with white lists. Anything that is not included in the whitelist must be moderated. 13. Prevent users from launching scripting programming languages ​​(vbs, js and others) and unknown file extensions. If you doubt about openning link, transfer it to the IT department for verification on a stand alone virtual machine. 14. Open documents with macros only from trusted users. If you doubt about openning document, transfer it to the IT department for verification on a stand alone virtual machine. 15. If the user has launched a suspicious file, he should immediately contact the IT department. 16. Disable remote launch for powershell 17. Set 2FA Authorisation for network infrustructure. (Backups)

The data was deleted automatically, we, for our part, did not have time to save the deletion log

ok

Our team noticed that you have already started spreading dirty rumors to other companies. So, look, if this continues, we are starting data recovery for all the cases that we have worked with previously. Publishing all remote blogs and spreading information in the media that your companies (victims) paid us a ransom. Don't consider yourself an almighty friend. A new hacker worked with your case, who foolishly deleted the data after payment. This will no longer be the case, and rest assured that we do not store the data of the victims you paid for. Let's forget about this case and continue working. Don't try to fight.