Akira Ransomware Negotiation — Redacted Organisation

14Messages
UnknownDuration
UnknownInitial Demand
UnknownOutcome

About This Negotiation

This transcript documents a Akira ransomware negotiation with a redacted victim organisation. The negotiation consisted of 14 messages exchanged over Unknown.

The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.

Full Transcript — Verbatim

Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.

Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Akira] — — Message 1/14
> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
[Akira] — — Message 2/14
> Are you going to work with us.
[Akira] — — Message 3/14
> You can find your company name in our news column: [REDACTED URL] If you want this post deleted, we must come to an agreement.
[Victim] — — Message 4/14
> Hello. What exactly is this? What is going on?
[Victim] — — Message 5/14
> And who are you?
[Akira] — — Message 6/14
> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 7/14
> I need my files and pictures back
[Victim] — — Message 8/14
> Hello?
[Victim] — — Message 9/14
> What is going on. I never wrote you these things above. Did I log in tot he right place???
[Akira] — — Message 10/14
> Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
[Victim] — — Message 11/14
> How do i get my files back?
[Victim] — — Message 12/14
> Of course I am authorized to talk toy you on behalf of my organization. The problem is that it seems that someone who is NOT autorized to talk to you has access to this chatroom, because I did not write "How do I get my files back" above.
[Victim] — — Message 13/14
> Are other people have access to this platform under our password??
[Akira] — — Message 14/14
> We have just sent a code for a new chat to your leadership by email. Please check and contact us asap in the new chat. We are waiting.

Analyst Observations

Facing a Ransomware Demand?

Whether you choose to negotiate or refuse — having specialists in the room changes the outcome.