Avaddon Ransomware Negotiation — Redacted Organisation

73Messages
UnknownDuration
$45,000Initial Demand
UnknownOutcome

About This Negotiation

This transcript documents a Avaddon ransomware negotiation with a redacted victim organisation. The negotiation consisted of 73 messages exchanged over Unknown.

The initial ransom demand was $45,000. The final outcome is not confirmed in the transcript.

Full Transcript — Verbatim

Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.

Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Victim] — 08:02 24.03.2021 — Message 1/73
Hi sir we would like to discuss with you about the offer you gave us.
[Victim] — 08:08 24.03.2021 — Message 2/73
kindly help me to get the data back , otherwise i will be in problem sir,
[Avaddon] — 08:09 24.03.2021 — Message 3/73
You have been infected by the Avaddon ransomware. To receive a general decryptor, you need to pay the amount indicated to you in the BTC on the landing page. After paying the ransom, you will receive a general decryptor that will decrypt absolutely all PCs and servers on your network. We will also provide you with a list of vulnerabilities in your network so that a similar situation does not happen to you in the future.
[Victim] — 08:17 24.03.2021 — Message 4/73
Sir, im working as junior staff in the IT dept, the company can offer you maximum $2500 for to settle the offer. Kindly help me and save my job as well. God will help you sir,
[Avaddon] — 08:19 24.03.2021 — Message 5/73
Your price is 45,000 dollars. $ 2,500 is very small, we cannot agree to it.
[Victim] — 08:20 24.03.2021 — Message 6/73
sir , i will lose my job and family will be in diffculties . kindly help . god will help you
[Victim] — 08:26 24.03.2021 — Message 7/73
You know sir, current covid -19 pandemic really make all the human being life in difficulties. My first priority to save company data and my job. Your a unknown person, but I’m confident that you will help me to settle this problem. My pray will be with you. Kindly accept the offer and help me sir.
[Avaddon] — 08:37 24.03.2021 — Message 8/73
We can offer you a 5% discount.
[Victim] — 08:49 24.03.2021 — Message 9/73
Sir, we don’t have such amount to pay you. Kindly help me sir. I have to pay from pocket to remaining amount. I can make it $5000. You are good human being with good heart, helping me to settle this case. Kindly confirm and will pay you amount $5000 at the earliest.
[Avaddon] — 08:55 24.03.2021 — Message 10/73
We cannot agree on 5k. Offer more, much more.
[Victim] — 09:12 24.03.2021 — Message 11/73
sir, company agreed to arrange $10000 as the final settlement for data which you encrypted . we need to have some details to access and confirm. Kindly share some picture and proof to confirm. We will arrange the money and it is my bread and butter and kindly helps me to settle this case. God will help you and save you. God bless you.
[Avaddon] — 09:18 24.03.2021 — Message 12/73
If you refuse to pay the amount specified on the page, you can see all your files in our blog for leaks. I think you do not want, and your company is important reputation.
[Victim] — 09:23 24.03.2021 — Message 13/73
Sir, I never said, we will pay you. Kindly reduce the amount reasonably; we can’t attempt to get the 45k in this time. Due to the business challenges, we are small firm with limited sources. Kindly make reasonable offer to settle this issue.
[Avaddon] — 09:27 24.03.2021 — Message 14/73
We can offer you a 10% discount.
[Avaddon] — 09:28 24.03.2021 — Message 15/73
Your price is $40,000.
[Avaddon] — 09:30 24.03.2021 — Message 16/73
Price $ 10,000 still small
[Victim] — 09:33 24.03.2021 — Message 17/73
sir, sorry our offer 10k
[Avaddon] — 09:36 24.03.2021 — Message 18/73
If you want to return your files and do not want us to create a post about your company and have posted information about you there, then you need to offer us more than $ 10,000.
[Victim] — 09:40 24.03.2021 — Message 19/73
my kind request to help me, otherwise i will be in big problem. sir, help me to settle the case.
[Avaddon] — 10:12 24.03.2021 — Message 20/73
We understand the current situation and want to meet you halfway, but we cannot agree to such a low price. You need to think carefully and offer us more than $ 10,000.
[Victim] — 16:55 24.03.2021 — Message 21/73
Sir, i will be in very big problem, have my family and depends. if i loose my job all my depends will be big troble. Kindly consider the situation i am to pay this money from my pocket as i did not secure the system enough.
[Avaddon] — 17:01 24.03.2021 — Message 22/73
Why do you have to pay? Let the company pay the ransom.
[Victim] — 17:08 24.03.2021 — Message 23/73
Its becuase i have not kept the system safe enough, i am staying up from last night here in office not able to go home.
[Victim] — 17:09 24.03.2021 — Message 24/73
need your kind help and support.
[Victim] — 17:11 24.03.2021 — Message 25/73
pls accept this proposal. humble request to you my brother. i need to take training from you sir.
[Avaddon] — 17:13 24.03.2021 — Message 26/73
We do not give lessons.
[Avaddon] — 17:14 24.03.2021 — Message 27/73
We are ready to make a very big discount for you. $ 35,000 this is our last proposal, it cannot be less.
[Victim] — 17:24 24.03.2021 — Message 28/73
Sir, My company is giving only $5000 as i said earlier, remaning i have to pay from my pocket becuase of my mistake. how can i arrange remaning $30000 from my pocket. my salary is only $1000 per month.
[Victim] — 17:26 24.03.2021 — Message 29/73
sir please help me. God will help you and save you. God bless you.
[Avaddon] — 17:28 24.03.2021 — Message 30/73
I understand you, but the price is for the company. The company can afford to pay this amount. You yourself got yourself in a dead end when you wanted to pay from your pocket. Here we will not be able to help.
[Avaddon] — 17:32 24.03.2021 — Message 31/73
If your company does not want to pay the amount, then they will have more problems than to dismiss you. And they need to think about damage and reputation.
[Avaddon] — 17:34 24.03.2021 — Message 32/73
Talk to the boss and explain to him that he needs to pay a ransom if he wants to save time and not lose even more money for restoring the work order.
[Victim] — 17:42 24.03.2021 — Message 33/73
sir please help me, the ransom amount is very high, please consider something very near to my proposal then i will try to do something. need your kind help.
[Avaddon] — 17:55 24.03.2021 — Message 34/73
We will never agree in the amount of 10k or 15k!
[Avaddon] — 17:56 24.03.2021 — Message 35/73
You must collect more money. We already help you very much when it has reduced the price to 35k.
[Avaddon] — 17:59 24.03.2021 — Message 36/73
We can make a very big discount for you. You need to pay $ 30,000. If you want to return your files, you need to pay this amount. This is the last discount, the price cannot be lower.
[Avaddon] — 18:01 24.03.2021 — Message 37/73
We did everything you could, now your turn.
[Victim] — 19:14 24.03.2021 — Message 38/73
sir, i checked all the possible ways, maximum i could arrange is that $12000, Please please help me to close the proposal. tomorrow is the week end so need to close this as early as possible. its my humble request. please consider this which help me and my family members
[Avaddon] — 19:23 24.03.2021 — Message 39/73
We are not interested in 12k, the last price is 30k!
[Victim] — 19:28 24.03.2021 — Message 40/73
Sir, i can't reach upto 30K, its very huge amount for me. Please consider sir.
[Avaddon] — 19:33 24.03.2021 — Message 41/73
How much maximum can you offer?
[Victim] — 19:36 24.03.2021 — Message 42/73
Sir, i can arrange 1K more from my previose said amount. which also huge amount for me, and that to arrange by myself. Please help me on this.
[Avaddon] — 19:38 24.03.2021 — Message 43/73
How can we help you? We have already done a big discount for you.
[Victim] — 19:41 24.03.2021 — Message 44/73
i cannot improve from here. just cannot. please understand sir.
[Avaddon] — 19:46 24.03.2021 — Message 45/73
I understand, but I can not do anything.
[Avaddon] — 19:49 24.03.2021 — Message 46/73
We made a very big discount for you.
[Victim] — 19:49 24.03.2021 — Message 47/73
i dont know how to slove this problem, you guide me. i'm completely broke.
[Avaddon] — 19:51 24.03.2021 — Message 48/73
I do not know how and where you take money. You should do it.
[Avaddon] — 19:51 24.03.2021 — Message 49/73
Credit in a bank, lend from a friend, ask the boss. You should do it.
[Victim] — 19:53 24.03.2021 — Message 50/73
Accept my proposal of 13K, i have maxed my cards, loans everything. i dont have any options left.
[Avaddon] — 19:54 24.03.2021 — Message 51/73
I repeat, we cannot agree in the amount of 13k or even 15k. It's too little!
[Victim] — 19:57 24.03.2021 — Message 52/73
maybe be too little for you. But it will take too much time for me to repay back. on human ground please have mercy on me for gods sake.
[Avaddon] — 19:59 24.03.2021 — Message 53/73
Your price is 30k.
[Victim] — 20:19 24.03.2021 — Message 54/73
i have explained several times this is beyond my reach cannot arrange this.
[Avaddon] — 20:36 24.03.2021 — Message 55/73
And we explained many times that we cannot agree to less.
[Avaddon] — 23:00 24.03.2021 — Message 56/73
[REDACTED URL]
[Avaddon] — 23:00 24.03.2021 — Message 57/73
Password: [redacted]
[Avaddon] — 23:00 24.03.2021 — Message 58/73
Evidence that we have the files and we will publish them if you don’t find the money.
[Avaddon] — 23:13 24.03.2021 — Message 59/73
Sir, it seems to us that you do not quite understand the seriousness of the situation by offering us such a small price. Before the price of $ 45,000 for your network was set, we carried out a detailed analysis of your company's income and financial statements. We know about your financial capabilities so the price offered we are not satisfied with you. We are ready to give you a discount and offer $ 30,000 this is the lowest price. The files that we showed you are just a drop in the ocean, in fact, we have about 10GB of data pulled from your network and this data includes finance and accounting, passports, credit card data, agreements and contracts, tax data of your company for the last few years, confidential documents, data on your clients and tens of thousands of other data. Imagine the scale of the leak of this data and what consequences it will entail, such as lawsuits and proceedings. Your reputation will be severely collapsed. Also, if we make a post about you on the blog, then a DDOS attack will fall on your site 24/7 and your site will simply be inaccessible to your customers. Most importantly, this is not all that awaits you in our arsenal there are many more tools and techniques with which we will harm you more and more every day. We are a serious threat to your company and we ask you to take us and our proposals seriously. Consider our proposed price of $ 30,000 and let's cooperate.
[Avaddon] — 23:13 24.03.2021 — Message 60/73
Cooperating with us, we guarantee you complete confidentiality on our part, General decryptor with which you can restore absolutely all files on your PCs / Servers, a complete tree of the files we have taken from you and confirmation of their deletion after payment. We will also point out to you the vulnerabilities in your network and give recommendations on what to do to eliminate these vulnerabilities, following our security recommendations, you will be practically invisible to hacker attacks.
[Victim] — 11:54 25.03.2021 — Message 61/73
hi sir how are you doing. request you to agree $15k to close the deal. i will arrange the payment according to your confirmation.
[Avaddon] — 11:57 25.03.2021 — Message 62/73
Hey!
[Victim] — 11:57 25.03.2021 — Message 63/73
sir, confirm
[Avaddon] — 11:58 25.03.2021 — Message 64/73
We already wrote earlier that this is not enough. Your price is 30K.
[Victim] — 11:59 25.03.2021 — Message 65/73
we can do 15k as the final deal.
[Victim] — 11:59 25.03.2021 — Message 66/73
30k is too high to agree
[Avaddon] — 12:01 25.03.2021 — Message 67/73
Look for money.
[Victim] — 12:02 25.03.2021 — Message 68/73
sir you need to be kind.... help us to sort this case.
[Avaddon] — 12:10 25.03.2021 — Message 69/73
We can help you when you have 30K
[Avaddon] — 06:06 28.03.2021 — Message 70/73
Hi sir
[Avaddon] — 06:06 28.03.2021 — Message 71/73
what is the maximum price you can offer us?
[Avaddon] — 06:07 28.03.2021 — Message 72/73
I ask this because we are already dealing with your files and soon they will be on the blog
[Avaddon] — 06:07 28.03.2021 — Message 73/73
It is interesting to hear your last sentence.

Analyst Observations

Facing a Ransomware Demand?

Whether you choose to negotiate or refuse — having specialists in the room changes the outcome.