// Context
About This Negotiation
This transcript documents a Akira ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 55 messages exchanged over Unknown.
The initial ransom demand was $690,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — — Message 1/55
> Hello
[Victim] — — Message 2/55
> hello
[Akira] — — Message 3/55
> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
[Victim] — — Message 4/55
> Hello
[Akira] — — Message 5/55
> Do you see our messages?
[Victim] — — Message 6/55
> hello
[Akira] — — Message 7/55
> Please refresh this chat periodically.
[Victim] — — Message 8/55
> Hi
[Victim] — — Message 9/55
> What are the steps to recovery?
[Akira] — — Message 10/55
> Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
[Victim] — — Message 11/55
> yes
[Victim] — — Message 12/55
> any update?
[Akira] — — Message 13/55
> Please confirm you have a permission to conduct a negotiation on behalf of your organization and we will proceed with the details.
[Victim] — — Message 14/55
> yes, i have permission
[Victim] — — Message 15/55
> do you need any information?
[Victim] — — Message 16/55
> hello?
[Victim] — — Message 17/55
> ?
[Victim] — — Message 18/55
> hi?
[Akira] — — Message 19/55
> The longer you ignore our question, the longer you remain non-operational.
[Victim] — — Message 20/55
> i have permission to negotiation
[Victim] — — Message 21/55
> you need a proof?
[Victim] — — Message 22/55
> I need information on how recovery works
[Akira] — — Message 23/55
> I need you confirmation that you have a permission to conduct a negotiation on behalf of your company and make financial decisions.
[Victim] — — Message 24/55
> yes, i have permission to negotiation
[Victim] — — Message 25/55
> what information do you need?
[Victim] — — Message 26/55
> I'm ready to negotiate. How much?
[Akira] — — Message 27/55
> Are you kidding us? Please answer our question and we will proceed.
[Victim] — — Message 28/55
> Maybe I didn't understand your question. You questioned whether I am allowed to negotiate. The answer is yes, I have permission. Do you need any additional information that I didn't send? It's confusing. What question do I need to answer? I am the owner of the company, and I need to negotiate.
[Akira] — — Message 29/55
> list.rar // 848 KB
[Akira] — — Message 30/55
> These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back.
We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
[Victim] — — Message 31/55
> show me these files, please: E:\[redacted].doc E:\[redacted].doc
[Victim] — — Message 32/55
> [redacted].ini.akira // 1.35 KB
[Victim] — — Message 33/55
> and decrypt this .ini, please
[Akira] — — Message 34/55
> files.rar // 145 KB
[Victim] — — Message 35/55
> ok, and can you decrypt the .ini too?
[Victim] — — Message 36/55
> ?
[Victim] — — Message 37/55
> Do you have access to just the documents on the list, or are there more documents?
[Victim] — — Message 38/55
> If you choose partial, is it done per server, or per file?
[Akira] — — Message 39/55
> We will decrypt every file that we encrypted. The list reflects everything we took. We do not decrypt per file.
[Akira] — — Message 40/55
> The price for the whole deal is $690,000. You can send us encrypted files for test.
[Victim] — — Message 41/55
> I will send the file for testing
[Victim] — — Message 42/55
> [redacted].ini.akira // 1.35 KB
[Victim] — — Message 43/55
> You did it?
[Akira] — — Message 44/55
> What do you mean? Will you send encrypted files?
[Victim] — — Message 45/55
> I will send the file for testing
[Victim] — — Message 46/55
> [redacted].ini.akira // 1.35 KB
[Akira] — — Message 47/55
> Wait a bit.
[Akira] — — Message 48/55
> decrypted.7z // 494 Bytes
[Akira] — — Message 49/55
> You can review. Ready to move to payment? Once you confirm I will give you our BTC wallet.
[Akira] — — Message 50/55
> We are waiting for your decision regarding the deal within a few hours.
[Akira] — — Message 51/55
> We see no decisions from you. Are you going to work with us?
[Victim] — — Message 52/55
> We are assessing your proposal. It’s a tough financial decision. Please give us more time.
[Akira] — — Message 53/55
> Hope 24 hours will be enough.
[Akira] — — Message 54/55
> Have you decided something? We are going to announce the leak today.
[Akira] — — Message 55/55
> You can find your company name in our news column: [REDACTED URL] If you want this post to be removed, we have to agree on something.