// Ransomware Negotiation Transcript
Hive Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a Hive ransomware negotiation with a redacted victim organisation. The negotiation consisted of 70 messages exchanged.
The initial ransom demand was $500,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
Hello and welcome to Hive.
How may I help you?
i saw a text file and it had login info to come here.
To decrypt your files you will need to pay $500,000.
The price is not a subject to discuss.
i think theres a mix up or something. i am apr supply like it says here, but weve never had that much revenue. could there be a mixup? $500,000 would be impossible for me to pay
is anyone here?
The price isn't negotiable.
What happens if I can't pay?
Nothing. You will not be able to decrypt. Your exfiltrated files will be disclosed. We will make calls to your partners and customers to notify them about the incident.
does exfiltrated files mean you took files from me?
yes, not so much, but it will be enough to confirm the incedent
what files did you take?
can you show me what files you have?
how can i know you can fix my files?
did you take any files?
is anyone here
You are able to upload encrypted files and a key file locates at C:\*.key.*
Encrypted files must not contain important info in it.
k Ill upload them
there
can u open these
I have uploaded decrypted file
ok that file worked
how do i know which files you took from me?
You will get an access to your exfiltrated files storage
can you prove that you took any files?
Yes, we will do that in few hours.
Done, you can check it.
this is a list of files from my computer. are you saying you have these? how can i know this for sure?
Select any without important info in it and we will upload it for you
2021 show discounts.xlsx
[redacted] VENDOR NOTES.docx
[redacted] customer sales April – June 2019.xlsx
Okay, few min
thanks
Done
thanks
Hello, the timer is almost gone.
We will publish your data soon.
alright. im gathering up all my funds and will let you know how much i can pay
i can pay you $84,600.
i dont need a program to fix my files, but id like to keep my files from being published on the net if possible
To convince you to pay we can make calls to your partners and customers to notify them about the incident.
i can pay. i said i have 84,600
The price is $500,000.
ill need time to find more money.
I'll wait
okay. if my files or name is posted before i pay, i wont pay. i don't know what this timer is counting down to
I have extended it
thanks
You have to make a decision.
okay. i got a SBA 7(a) loan and put up all my assets as collateral so i can pay you. it hasn't funded yet, but should in the morning. when it does, i'll have a total of $112,838 that i can pay you. i know the price if $500k, but i just dont have that much money.
if this is enough, please explain how i get the money to you. thanks
hello? is $112,838 enough? if so, how do i pay?
To decrypt your files and to prevent them to be disclosed you will need to pay $500,000.
The price is not a subject to discuss.
im trying to get as much money as possible and as fast as possible. im going to need more time. ill keep working on this through the weekend and see how much more i can get. i wont be able to find over 300k and pay in an hour
thanks. the timer expires on Sunday. Even i can find all the money by then, i won't be able to pay until monday. it would be helpful to not have to worry about the timer until tuesday to give me time to figure out the bitcoin
Okay
thank you
Okay, I'll give you time
Hello?
Hi! I'm here. I was able to get more money. Waiting for confirmation of the amount. I'll let ya know asap
Okay.
hi. i have confirmation from my team that we have $275,800 available. i contacted a couple of bitcoin sellers so should be able to figure that part out as well. is this enough that we could pay?
Okay, I agree
At the time of transfer, the amount have to be equal $275,800 in BTC.
I will transfer the funds to bitcoin company on monday.
The timer will run out before then, but I'm guessing that it shouldn't be a problem. Thank you for your help
Okay.
What is ETA on the payment?
Hi there! My bank is scrutinizing the wire transfer from me to coinbase. They are asking a lot of questions because they say these types of transfers are related to fraud. I'm telling them that I'm investing in bitcoin, so it should be okay. I'll let you know.
Okay.
It's time to pay
// Analysis
Analyst Observations
- Hive ransomware was infiltrated and disrupted by the FBI in January 2023 in a major law enforcement operation that provided decryption keys to victims.