// Context
About This Negotiation
This transcript documents a Akira ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 43 messages exchanged over Unknown.
The initial ransom demand was $350,000. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — — Message 1/43
> hi
[Victim] — — Message 2/43
> hi
[Victim] — — Message 3/43
> hi
[Victim] — — Message 4/43
> anybody out there?
[Victim] — — Message 5/43
> hello?
[Akira] — — Message 6/43
> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.
Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 7/43
> nobody seems to be there, we will come back later
[Akira] — — Message 8/43
> Do you see our messages?
[Victim] — — Message 9/43
> hi there, got another tor browser, now I see your messages
[Victim] — — Message 10/43
> yes, I have a permission to negotiate on behalf of my organization
[Akira] — — Message 11/43
> Please wait for details.
[Victim] — — Message 12/43
> hello?
[Victim] — — Message 13/43
> I can't see any message after your "Do you see our messages?"
[Victim] — — Message 14/43
> I will come back to check new messages
[Victim] — — Message 15/43
> hello?
[Akira] — — Message 16/43
> Can you see my message?
[Victim] — — Message 17/43
> yes
[Victim] — — Message 18/43
> now I see "Can you see my message?", but I had to log out and log in again
[Victim] — — Message 19/43
> it seems that I don't get an update in the chat directly
[Victim] — — Message 20/43
> we will come back later as "please wait" seems to be a bit longer
[Akira] — — Message 21/43
> List.rar // 2.48 MB
[Akira] — — Message 22/43
> These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.
[Victim] — — Message 23/43
> I got the list and will check which files we want to see as prove of possession
[Akira] — — Message 24/43
> Standing by.
[Victim] — — Message 25/43
> we would like to see the following 3 files:
[Victim] — — Message 26/43
> D:\[redacted].log
[Victim] — — Message 27/43
> D:\[redacted].refs
[Victim] — — Message 28/43
> D:\[redacted].png
[Akira] — — Message 29/43
> Please wait.
[Victim] — — Message 30/43
> Take your time, I will come back on monday
[Victim] — — Message 31/43
> hi there, back again and ready to receive your files
[Akira] — — Message 32/43
> The files will be uploaded shortly.
[Akira] — — Message 33/43
> files.rar // 19.6 KB
[Akira] — — Message 34/43
> Please review. Give me encrypted files asap, if you want to test our decryption tool.
[Victim] — — Message 35/43
> got your files and check them, will come back with encrypted files asap
[Akira] — — Message 36/43
> We are standing by to the files.
[Victim] — — Message 37/43
> [redacted].akira // 21.6 KB
[Victim] — — Message 38/43
> uploaded the one file to test the decryption tool
[Akira] — — Message 39/43
> [redacted] // 21.1 KB
[Victim] — — Message 40/43
> ok, matches, so: what next?
[Akira] — — Message 41/43
> So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $350,000 price for ALL the services we offer:
1) full decryption assistance;
2) evidence of data removal;
3) security report on vulnerabilities we found;
4) guarantees not to publish or sell your data;
5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
[Victim] — — Message 42/43
> We decline and will not pay anything. This conversion is over.
[Akira] — — Message 43/43
> OK. Thank you for the information.