// Ransomware Negotiation Transcript
Darkside Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a Darkside ransomware negotiation with a redacted victim organisation. The negotiation consisted of 10 messages exchanged.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
Hello, [redacted]. We downloaded more then 500 GB of sensitive data
from your network, if you don't pay, we will publish them.
We know that you have 3 million cyber insurance police from Response
Limit, you must contact Beazley Group to take money for payment.
Also, we know about your 45 millions credit line. So, please, don't say us that you haven't money or etc.
Shares of your company ([redacted]) are traded on NASDAQ. If you don't contact
us, we will notify all the biggest mass media about your company hack
and data leak, what will lead to the fall of the price of your shares.
And you can be sure, we always do that was promised.
Since you ignore us, we prepare the data to publication.
We are confident that your company will be a good example for others and create us good advertising.
We will start publish your data after 6 days 14 hours.
We also prepare the list of the press that we will notify about your leakage, we will soon provide you with a list.
In the case of payment, we guarantee:
- Non-disclosure of information about your hacking.
- Providing you windows and linux decryptors.
- Help with the recovery your data.
List of the press who will be sent links to your data after the publication:
- [REDACTED URL]
- [REDACTED URL]
- [REDACTED URL]
- [REDACTED URL]
- [REDACTED URL]
- [REDACTED URL]
We also found several traders who want to earn on the fall of your shares.
Are you ready for what will happen after the publication?
2 days left.
In 2 days your post will become public, we will notify traders in advance, in 3 days we will publish your data.
You have the last day to resolve this.
We are ready for a dialog, you should write.
Tomorrow we will begin to fulfill all our promises. Good luck.
Are you ready for a dialog?
// Analysis
Analyst Observations
- DarkSide is best known for the Colonial Pipeline attack in May 2021. The group shut down shortly after due to law enforcement pressure.