Avos Ransomware Negotiation — Redacted Organisation

As you are an enterprise client of ours, we will provide you with customer support throughout the process. You may use this chat to get in contact with us.

I'll ask all that to the affiliate in question.

Are we still connected?

Disconnect you how? Yeah, I'll set your deadline on Friday next week.

Just give it a couple seconds, the website can be slow at times

I can't reach the affiliate responsible for the attack at the moment. I did tell him to provide you with a sample or list of the files exfiltrated. They'll reply here when they're back.

Sure, good night.

Yeah don't worry about that, your new deadline's set at Friday next week

I can't contact the affiliate in question. They seem to be unavailable at the time. I won't be able to provide you information on the data taken. I, however, can provide you the decryption keys if you do pay for it.

Are the extensions appended to the encrypted files ".avos2"?

Avos2 came out recently and we can't provide test decryptions on our website for it at the moment.

You can create an archive with couple files and upload them to [REDACTED URL]

Then I can manually decrypt the files for you. We can decrypt .avos2, however the website can't at the moment.

This is because both the encryption/decryption are first built and tested in Windows, THEN this encryption algorithm is ported to our web services.

You are supposed to copy the URL in your browser instead of copying the link from the download button.

Hello? The link doesn't work

Your link doesn't work, again.

Please test and verify that it works BEFORE sending it to me.

[REDACTED URL]

Please upload it to one of the websites I've told you to. We can't download from Gofile.

We've downloaded the data. Please allow us some time to process it

I decrypted the PNG files. [REDACTED URL]

Hello. We think it's time to finalize your negotiations. Please let us know how do you wish to proceed with payment.

You can see the files in few days if we have to publish samples on the blog. We will not provide anything else at this stage.

As staff, we can guarantee that whatever data the affiliate has taken will be erased, and the decryption keys will be delivered.

Your new deadline, that we both agreed on, was set on the 10th, Friday. I'll leave the rest to the affiliate.

Those are our terms and we never go against them. You know better than us what data we took. We took it from the servers we encrypted. Anyways, we are away with no access to data storage, so another scenario is not possible. Staff can help to decrypt if you reach an agreement. Data will be erased when we come back.

I can confirm the data in question wasn't downloaded to our storage units but the affiliate's.

For now I'd suggest that perhaps your management should appraise the value of the decryption itself.

Considering the affiliate wasn't able to provide a sample/list, I think we can settle at 150K in Bitcoin.

What about 100K?

Alright that's fair I suppose. Let us know when you have the money in BTC.

I'll send that to you in a bit

[redacted]

Do tell your guy to make a test transfer of 10$ and get a confirmation from me before he sends the full 85K

I can confirm all but the 3rd, as we don't have access to your data. However I can guarantee an erasure of your data.

Confirmed. You may continue with the transfer

As soon as it confirms.

Bitcoin takes some time to receive basically

The payment confirmed. Thank you for your business. The affiliate should provide the security report.

Defend your credentials from mimikatz Limit administrator privileges to the smallest group possible. Even if you have thousands of user accounts, you should probably only have 2-5 administrator accounts. Start with two accounts and force users to justify any additional accounts added to the administrator group. The next thing that you should do is upgrade the schema and functional level of your forest and domain to at least 2012 R2. This domain functional level adds a fairly new group called “Protected Users”. Along with other protections, the members of the Protected Users group cannot authenticate by using NTLM, Digest Authentication, or CredSSP. These changes provide powerful protections that make Mimikatz almost worthless. Verify KB2871997 has been installed to apply additional required security. After you install this security update, the default setting for non-protected users on Windows 7 and Windows 8 is to not force clear leaked logon session credentials.

To override this default you can add the following registry dword, TokenLeakDetectDelaySecs, and set it to a recommended value of 30 seconds. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ Stop storing passwords in memory by changing the “UseLogonCredential” registry setting to ‘0’ instead of the default value of “1” and passwords are no longer available to Mimikatz . HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\WDigest Start monitoring your systems for unauthorized software and malware, which should help identify Mimikatz installation and activity. You’ll have to test these changes to see what breaks, but the idea is to implement some fairly basic changes to protect your network. In your specific case the critical vulnerabiliry contained Forti VPN, please update FortiVpn and monitor for updates and Windows updates. Inform your IT stuff to remove the posibility of storing user passwords within the network.

Also we recommend you to use SentinelAV and dattoo backup system. Also Veeam Tapes is good ,but pc with veeam should be in WORKGROUP and user should be different from main domain. Every PC should have AV. Don't let any pc without AV. Also try configure 2FA (at all network pc) when you connect to remote desktop. Use password on AV. Also tip for you: If you want chage Fortigate VPN to other . We dont reccomend you to use Sonic VPN,Pulse Secure, because its under massive hack

And finally, update your Exchange Server, since it was the main entry point.

As for data, we instructed an erasure and it was confirmed all your data is erased. So you are safe. Thank you for your business.

It'd be better for your IT to reach out directly if possible if anything's to occur