fog Ransomware Negotiation — Redacted Organisation

hi

I will give you details soon and we will talk

[provides a compressed RAR files list] this is what's been taken

when you pay you receive decrypter to fix your systems

I will tell you the price for decrypter soon

yes I can confirm your files will be deleted and your name will not be published

I will tell you price soon

If you want your data fully decrypted and the files we stole removed from our source, you will have to pay a fee. We will also be able to provide a security report and explain how we did it to get in. The bosses are demanding $800,000 for said services.

Do we work?

There's no way we're going to agree to that amount. I don't think we can even give you a $150,000 discount. our demand is more than reasonable in your case. I will talk to the bosses

bosses agreed to take 715k for everything

yes

give me a few

give me some time

[provides 5 decrypted files]

I cant close the case at your previous offer

you need to add something to your offer

I talked to the bosses. $500,000 and we can end this today. I don't think that you will get any better deal

bosses agree to take 350k today

this is the best bet price for the situation

tell me when ready to make payment

just take one last step, and we'll put this behind us.

bosses can take one last step and decrease to 300k. the wallet is [redacted]

hi

are you leaving me?

tell me should I wait the money today or what

I need your decision guys.

this week we have to close your case

I can't take 225k

confirm 250k to me and I will make my bosses take the offer 250k

we can do that today only

hello. what is your decision?

I can confirm that you will receive the .exe files that you will need to run on your systems (win or esxi) to decrypt your files. We guarantee that you will be able to recover all the encrypted data. We will give you a deletion log file which means the files we stole .were removed from our source.

Please let me know when the money has been sent

hi

can you tell me when are you going to make payment?

yes send please

I received 0.0001 btc. you can send the full amount now

waiting, thanks

[provides the decryptor in a 7zip compressed file] Windows unlocker.exe -nomutex -console -target \\SERVER\C$ unlocker.exe -nomutex -console -target C:\ Esxi \ LINUX chmod +x unlocker_key ./unlocker_key --id [redacted] --log --target "/vmfs/volumes/"

all domain admins passwords "gotochatplease"

I will tell you soon

You data has been deleted. Access to your network was gained through a phishing mail. Your staff should be more vigilant when downloading and opening unfamiliar files. We recommend that you implement the following measures to protect your corporate network: 1) Enforce passwords on local and domain admins. Complicate group policy on passwords for all users; 2) Using the group "Protected users"; 3) Use centralised management of antivirus protection; 4) Inform users not to open suspicious emails and files; 5) Updating software and OS to current versions; 6) Set up permission delegations in the Active Directory; 7) Install an application to monitor activity in the Active Directory; 8) Use Vmware Esxi ver. 7.0 or more current. Our team guarantees that any data taken from your network will not be disclosed, sold or published. Of course, this dialogue will also remain confidential.