// Ransomware Negotiation Transcript
fog Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a fog ransomware negotiation with a redacted victim organisation. The negotiation consisted of 73 messages exchanged.
The initial ransom demand was $290,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
We have found what appears to be your notes on our systems with links that we have followed here. What are the next steps and what is going on?
Hello. Wait please. I'll get back with details.
Hello? Any news?
[provides a plain TXT files list]
that's what's been taken from your network
We can decrypt your systems in a couple of hours for only $290,000. Just send us 3 random encrypted files to be sure - we'll decrypt them for free.
Can you send us the files from the list we have provided below?
08/29/2024 04:28 AM 98,075 [redacted].pdf
08/29/2024 06:59 AM 165 [redacted].xlsx
08/29/2024 03:50 AM 15,571 [redacted].xlsx
08/29/2024 03:59 AM 28,381 [redacted].docx
08/29/2024 04:01 AM 32,193 [redacted].pdf
[provides a 7zip compressed archive]
Hello, we are still working on gathering encrypted files small enough to send over to you, but it's almost impossible to find any due to the way all of our systems were locked up in the first place. We hope to have something soon, but we will reach back out once we do.
I can wait until Monday only
Hello, we are still trying to pull some sample encrypted files to send to you but we are running into a lot of issues because our systems aren't available to grab the files off of. We will hopefully have a file or two tomorrow to send over.
I hope so
I cant wait more
Ok, we will have those files over today.
I wait
[provides 3 encrypted files]
Please see the attached files.
[provides 2 decrypted files]
its time to perform payment
Hello, thank you for your patience to this point as we try and navigate our way through this. We have been working at verifying and reviewing everything you’ve given us and while we want to get this resolved, we simply don’t have 290,000 to send you. Is there any discount from you to be had so that we can maybe get this to some sort of resolution with you?
if you make payment by Saturday evening I can take 255k to get to a resolution
Hello, thank you for your patience to this point as we try and navigate our way through this. We have been working at verifying and reviewing everything you’ve given us and while we want to get this resolved, we simply don’t have 290,000 to send you. Is there any discount from you to be had so that we can maybe get this to some sort of resolution with you?
if you make payment today evening I can take 255k to get to a resolution
Thank you for the reduction, but even at that number it’s more than we have on hand. Can you please give us a number that we can take back to the firm’s leadership and see what can be done?
what did you leadership said about 255k?
what do you have on hand?
I see
I will leak your files
We are still interested in getting a decryptor to unlock a small portion of our data, but it’s not nearly worth 255,000. What is the lowest number you will take?
I will wake 255k
what is it worth?
what would you say?
Hello, we are willing to pay 25,000 so we can both move on from this. That’s about what it would take for us to just completely reconstitute the data anyway.
how much would it take for you to keep this situation secret?
$25,000 is what we have and could send you as soon as possible
you don't care if your files leaked?
no I don't take 25k
I can take 150k if you need decrypter only
While we appreciate the reduction for just the decryptor, we would also like for our data to be deleted from your possession and for proof of that being deleted. We can come up on our price, but we don’t have what you are asking for. We can do $60k that we can send immediately, and is more than double what we offered before. But that’s all we have onhand to send. Please consider our offer and we will get the process started of sending that money over to you.
$200,000 for data deletion and unlockers. You have the last chance
Hello, it’s taken us quite a while, but we have been able to source an additional 40,000 and we can now offer you 100,000 to get this done as soon as possible. This has been very stressful for us and we have exhausted all avenues of getting additional funding. If you accept, we will get the process started to send the money to you ASAP.
hi
I cannot accept this for both data and unlockers but ok I can accept that for unlockers only
175k for everything would let me get it resolved today
hi
are you leaving me?
Honestly, it's taken us this long just to collect what we've been able to collect and at the price that you're wanting, we'd just rather put the extra 75k into rebuilding the data we're missing. We've been trying to come to an agreement here, but we've exhausted all options and this is what we have.
Does it mean our deal is off?
Do you understand that your files will be leaked?
[REDACTED URL]
Hello, the deal is not off. We have offered what we think is a generous offer to have a small portion of our data unlocked that we weren’t able to retrieve from backups. If you are going to walk away from 100,000 just to release our data, then we will have no choice but to reconstruct the data with that 100,000 and move on.
hi
ok send 100k here [redacted] and we get this resolved
tell me when ready to send
We are in the process of converting the funds now. I will reach back out once we have that process complete. Just so we are clear, you will provide us with a decryptor, proof of you deleting our data, and a report on how you got into our network?
Yes, we will provide you with everything you outlined.
Hello. How long should I wait? Next week I will have to leak your files.
Payment has been made. Can you please provide the items as soon as possible?
received. wait please
Hello, can you please provide the items to us?
Windows
unlocker.exe -nomutex -console -target \\SERVER\C$
unlocker.exe -nomutex -console -target C:\
Esxi \ LINUX
chmod +x unlocker_key
./unlocker_key --id [redacted] --log --target "/vmfs/volumes/"
Can you help us out with some files that don't see to be decrypting? I've attached them.
wait
The decryptor that we have isn't working on these files. Can you send me a decryptor that works?
Give us error logs and explain your actions in more details.
These are the best logs we can find.
We're just attempting to run the decryptor and it's simply not decrypting some of the files.
wait
are you trying to decrypt files on windows?
Yes
the problem is the path to files is too long
the decrypter works correctly
try to fix files in a different folder
We shortened the path and it's still not working
give us the log as well
// Analysis
Analyst Observations
- This transcript documents a fog ransomware negotiation. The exchange provides insight into the group's negotiation tactics and communication style.