// Context
About This Negotiation
This transcript documents a Akira ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 67 messages exchanged over Unknown.
The initial ransom demand was $200,000. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — — Message 1/67
> I don't unnderstand what this is.
[Akira] — — Message 2/67
> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 3/67
> Yes, I am the IT admin assitant.
[Akira] — — Message 4/67
> listing_[redacted].txt // 724 KB
[Akira] — — Message 5/67
> These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.
We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.
[Victim] — — Message 6/67
> I guess we need decryption assistance.
[Akira] — — Message 7/67
> We'll let you know our price for the decryption tool soon.
[Akira] — — Message 8/67
>
We accept payments in bitcoins. To gain bitcoins you have to go to any exchange platform as binance or coinbase. Here are the guides: [REDACTED URL]
[REDACTED URL] You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. We are the ones who can properly decrypt your data and restore your infrastructure in a short period of time.
After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. You will be able to restore your infrastructure within 24 hours. If you face any problems during decryption process, we will be here to support. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure.
You will also receive written guarantees that we will keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. Our price is $200,000. Once you confirm the sum, I will drop off our wallet ID.
[Akira] — — Message 9/67
> For $250,000 we will also delete your data.
[Victim] — — Message 10/67
> can you show me these files: [redacted].doc [redacted].pdf [redacted].xlsx [redacted].xlsx [redacted].docx [redacted].docx
[Victim] — — Message 11/67
> also here are some files for a test of the decryptor
[Victim] — — Message 12/67
> [redacted].doc.akira // 1.86 MB
[Victim] — — Message 13/67
> [redacted].pdf.akira // 115 KB
[Victim] — — Message 14/67
> [redacted].xlsx.akira // 14.7 KB
[Akira] — — Message 15/67
> Please wait.
[Akira] — — Message 16/67
> files.rar // 4.29 MB
[Akira] — — Message 17/67
> Here are the proof files.
[Akira] — — Message 18/67
> [redacted].doc // 1.86 MB
[Akira] — — Message 19/67
> [redacted].pdf // 115 KB
[Akira] — — Message 20/67
> [redacted].xlsx // 14.2 KB
[Akira] — — Message 21/67
> Here are the decrypted ones. Ready to move to payment?
[Victim] — — Message 22/67
> Appreciated. We are scrambling to offer any amount as we are completely in unknown territory here. Can we reach a deal of 50,000? this is a lot of money for us.
[Akira] — — Message 23/67
> We appreciate your offer but it is far away from a fair deal that we're here trying to reach. As a goodwill, we're willing to accept $200,000 which is capable for you to handle. You're well aware of the financial and reputational consequences in case we fail to agree. Let's be objective.
[Victim] — — Message 24/67
> We understand and this is why we attempt with approval to offer 95,000 to reach the deal with you.
[Akira] — — Message 25/67
> I'll discuss with my team and be back here.
[Akira] — — Message 26/67
> So, we can accept $150,000 as final. We won't go any lower. Here is our BTC wallet [redacted] It's up to you.
[Victim] — — Message 27/67
> We understand and agree to the 150,000 amount.
[Victim] — — Message 28/67
> If you can confirm these deal points, then we have reached a deal -
[Victim] — — Message 29/67
> 1. Decryptors right away, and full decryption assistance
[Victim] — — Message 30/67
> 2. Confirmation of which files you exfiltrated – full file list
[Victim] — — Message 31/67
> 3. Guarantees never to publish or sell our data – or to publicize or leak anything about this incident
[Victim] — — Message 32/67
> 4. Guarantees never to attack us or our customers in the future
[Victim] — — Message 33/67
> 5. Physical copy of all data exfiltrated – provide a link to download
[Victim] — — Message 34/67
> 6. After we download the data, your evidence and secure proof data deletion
[Victim] — — Message 35/67
> 7. Information about how you entered our systems – security report
[Victim] — — Message 36/67
> 8. When we approve, you will delete this chat and all logs and other data about this incident
[Victim] — — Message 37/67
> Please confirm and let us know when you are online to give us decryptors
[Akira] — — Message 38/67
> We confirm. I'll provide our BTC wallet soon.
[Akira] — — Message 39/67
> Here is the wallet: [redacted]
How soon should we wait for a transfer? We expect to get payment before the weekend.
[Akira] — — Message 40/67
> The terms we agreed on are valid before the weekend.
[Victim] — — Message 41/67
> Confirmation is appreciated.
[Victim] — — Message 42/67
> We will make the transfer this morning. Please prepare the decryptors to transfer to us right away
[Victim] — — Message 43/67
> We see 2 wallets in chat. Please confirm we should transfer to lastest one: [redacted]
[Akira] — — Message 44/67
> We're prepared.
[Victim] — — Message 45/67
> OK, we will send shortly to wallet: [redacted], standby
[Akira] — — Message 46/67
> Waiting.
[Victim] — — Message 47/67
> transfer completed. you can check it
[Akira] — — Message 48/67
> win_unlocker_[redacted].ex_ // 759 KB
[Akira] — — Message 49/67
> unlocker.exe -p="path_to_unlock"
unlocker.exe -s="C:\paths.txt"
where "paths.txt" is a list of paths for the decryptor, each path on a new line
[Akira] — — Message 50/67
> We've started uploading your data to mega storage. This process will take us 2-3 days approximately.
[Victim] — — Message 51/67
> Thanks, received. When will you provide the data dowload link?
[Akira] — — Message 52/67
> See the message above.
[Victim] — — Message 53/67
> yes, the chat did not refresh
[Victim] — — Message 54/67
> Can we receive the security report and information about how you entered our systems
[Akira] — — Message 55/67
> Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer.
2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources.
3. Install 2FA wherever possible.
4. Use the latest versions of operating systems, as they are less vulnerable to attacks.
5. Update all software versions.
6. Use antivirus solutions and traffic monitoring tools.
7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one.
8. Use backup software with cloud storage which supports a token key.
9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc.
[Akira] — — Message 56/67
> mega.nz
[redacted]@proton.me
w[redacted]
archive password: [redacted]
[Victim] — — Message 57/67
> one of the files did not upload correctly can you please re-upload the file called [redacted].part6.rar
[Akira] — — Message 58/67
> This file is correct. The downloading was interrupted and this archive was corrupted. We can't do anything with this.
[Victim] — — Message 59/67
> so you cannot re-upload it again?
[Victim] — — Message 60/67
> hello? the file in the mega one of the is not complete. You stopped the upload can you put it there again please and if something is wrong, can you say what files were there?
[Akira] — — Message 61/67
> I've passed it to my team. Please wait.
[Victim] — — Message 62/67
> Hello, how is this file re-upload progressing?
[Akira] — — Message 63/67
> Hello. This archive cannot be re-uploaded because it was corrupted while we downloading this FROM your network. We got this archive like this. Sorry for misunderstanding.
[Victim] — — Message 64/67
> Okay thanks for your help. Can you please delete all data you have about the situation and provide evidence of secure deletion?
[Akira] — — Message 65/67
> Sure. I'll provide the file within 12 hours.
[Akira] — — Message 66/67
> Deletion.7z // 87.3 KB
[Akira] — — Message 67/67
> Apologies for the delay.