REvil Ransomware Negotiation — Redacted Organisation

Good evening Sir/Madam. I'm [redacted], and I was asked by the [redacted]'s executives to assist them in completing a business arrangement with you. I'm neither a technological expert nor a lawyer. I have a financial background and currently work in the public sector here in the [redacted]. As you probably understand, we would like to complete this unfortunate event as swift and clean as possible. Kindly let me know how should I call you and when should I expect your reply. Respectfully, [redacted].

Thank you Sir/Madam. I have no idea what kind of proposal I should make to you. We are an [redacted] charity run by [redacted]. We get money, public funds, and I have no experience in this occurrence. We are not a business. I understand that we need to pay a certain amount in order to get our systems back to full operation. Am I right? Respectfully, [redacted]

Sir/Madam, do you mean what is the amount we can pay in order to restore our systems? Respectfully, [redacted]

Sir/Madam, do you mean what is the amount we can pay in order to restore our systems? Respectfully, [redacted]

Sorry Sir/Madam, for sending twice. I'm a bit overwhelmed by stress and this experience.

Sir/Madam, I honestly don't know. I see that you request 4 Million USD which is almost 3M GBP. We will never be able to pay this amount. Should I now tell you how much we are willing to pay? Is this what you mean? My apologies to be very cautious. I don't want any mistake to happen here. It is the future of 50,000 pupils. Young kids. Respectfully, [redacted]

Sir/Madam, I understand. Please allow me to consult. Respectfully, [redacted]

Sir/Madam, I'm here and after intense conversations and internal consultations as you might imagine. Please refrain from hostile language. I will appreciate it. I was instruct to further elaborate with you couple of points, obviously after I did my own research about you and your highly professional capability and status.

Thanks Sir/Madam. I appreciate that. (1) What type of information will you provide upon completing the deal? (2) What type of information are you currently possessing? (3) How can I guarantee that data will not be further monetized upon completion of our deal? Thanks much in advance. [redacted]

Thanks Sir. I will convey this and revert shortly. Respectfully, Emilie

Thank you Sir. I believe that the last offer will not be required, however, I will be extremely thankful if you could at least tell me what information you have in your possession. I believe that this information is of utmost importance to determine the amount the charity will pay. Respectfully, [redacted]

Sir, I could not red your last message. Was it deleted deliberately? Respectfully, [redacted]

My apologies for typo. I meant "read".

Thank you Sir. I understand that. Mistakes happen at all times. We are all humans. I will forward your reply. What does this mean: [redacted] [redacted] [redacted] [redacted] [redacted] Is this a file? or a directory? I want to ask you in order not to look unprofessional in the eyes of my colleagues. Respectfully, [redacted]

Sir, does it suppose to mean anything of importance? Respectfully, [redacted]

Sir, you mean Credit Card details of the Charity owners? Is this what you have in your possession? I'm asking again in order not to cause any confusion, and the guarantee an decision making process which is based on accurate data. Thanks, [redacted]

Ohh, I understand. Thank you. I'll revert, hopefully tonight. Respectfully, [redacted].

Yes Sir. I do understand. And I'm confident enough in your wisdom to present me with an attractive information, in order to present your most valuable assets. Credit card information of employees is probably the most attractive asset. Respectfully, [redacted]

Sir, I'm aware of that. I will present a significant amount in my early AM tomorrow. The relevant decision makers are currently consulting. Thanks for your understanding. Respectfully, [redacted]

Good morning Sir.. Your TOR website is offline for quite some time now. Is it ok to continue using this platform? Respectfully. [redacted]

I got the mandate to make you an offer. Please let me know if it's ok to make it now?

Thanks Sir. We can pay 750,000 USD in XMR, provided that you will share with me the exact scope, volume, and significance of data that is in your possession. I would like to stress that this amount is far beyond what we understand is usually charged by your teams (based on recent news reports. I've turned to be an expert on your business in the last 3 days, Fortunately or unfortunately.) I do stress the data, rather than the decryption key, since I learned about your very positive reputation in providing decryption keys. Looking forward hearing your thoughts. Respectfully, [redacted].

Sorry, you mean 3 Million USD?

Oh God. No, this is so far of what we can pay. Please hold and I'll report to my colleagues and revert. Respectfully, [redacted].

Sir, we will not be able to pay that amount. Please advise. Respectfully, [redacted]

Sir, thank you for this frank answer. Your "client", my colleagues, are not a company, and it seems that your reply is of a general nature. We are a charity fund, [redacted] non-profit, and our resources are all public resources. I will be able to come back to my colleagues, once you provided me with any information which will make them re-evaluate their decision. One of your colleagues, in a recent interview, said that you don't like to bargain. So please, I'll appreciate if you will find me as a genuine partner with whom you share information in order to craft a deal which works for both of us. Respectfully, [redacted].

Thank you Sir. I appreciate your advise, however this can't be cosidered a valuable advise. I will need to understand the percularities of what you wrote above: (1) Publication of which information? (2) What do you mean soon? (even if we agree tomorrow, it will take 3-4 days of official approval and execution) and (3) what is the additional discount? Thank you for understanding, and I really grateful for your willingness to assist. Respectfully, [redacted]

Sir, your proposal set the price tag for publishing unknown information on 2.4M USD. I see no scenario that the charity board and trustees will approve this by tomorrow, in order to be executed by Saturday. Sir, if you want to take advantage of my expreienced services in deal making you will have to allow me (1) details of information you have, as this and the decryption keys are the corner stone of any decision which will be taken, and (2) set a reasonable price for a non-profit charity around 800-900K, to be paid at some point next week. I'll be here, throughout this process, to make sure that we are progressing as planned. Respectfully, [redacted].

Good morning Sir. My sincere apologies for not replying last night. I was cought up at another event. I will forward this information to the relevant people and contact you back later during the day. I thank you for all the assistnce you provide in order to terminate this unpleasent affair. Respectfully, [redacted].

Sir, are you one person or few people rotating in shifts. Asking because you are always available, and always accesible. And are you the one who can finalize a deal or you need any approval from higher level? Respectfully, [redacted]

Thanks. Ok. I working on our case in the next couple of hours. Will revert as soon as I have information. Respectfully, [redacted].

Sir, one of the trustees of the charity have asked me in private what are the chances of bringing the price down to 900K USD? He shared with me her internal conversations and her belief, like you and me, that a deal is better than any publication. However, she said, reviewing the information you sent will not convice the relevant people to pay that amount of many. It's about "risk management" she said. Decryption keys and that information should cost around 1M. What would be your answer to her? Please keep in mind that she is sharing her thoughts with me in private and I'm not that sure that she represents any majority. Please consult with the boss and let me know? Respectfully, [redacted]

I'll be back to this computer in 2-3 hours, Sir. Thanks. [redacted]

Sir, I'm thrilled. Thanks a lot. I'll convey this in my meeting with board and trustees in the morning. First time in last days that I'm going to bed with a smile. I'll contact you for further communication and updates in the morning. Best regards, [redacted]

Good morning Sir. Board and trustees of the charity will convene in 1.5 hours. I'm in direct contact, as I shared with you yesterday with one of the trustees, and she will update me immedietly after the meeting, even before the official statement. Respectfully, [redacted]

Sir, may I ask you a direct question? It's important that you will be completely honest with me, and if you don't know the answer, I would appreciate if you could check with the boss. Are you still interfering with our systems? Do you do any actions related to our employees? Awaiting your answer, [redacted]

Sir, I wish I could have brought you into the trustees meeting. In the middle of meeting when they discuss paying your suggested price, came this notice of your continued efforts to sabotage the charity network. With all due respect, Sir, do you think it was necessary? Do you think it was helpful? I'm doing a tremendous effort to show everyone your nice, welcoming and human face, and you keep on your evil moves? How should I show my face now? I guess that you haven't understood that you and me are working together to bring this deal? You have to assist me, not work against me..!

Are you completely confident about that Sir? I'ts not only your reputation here, it's mine as well. Thanks, [redacted]

Ok. I trust on that. I'll further communicate tonight. I need to go back, with this information, to do some damage control, and it starts to be late into the weekend. I'll come back later this evening. Respectfully, [redacted].

Good evening Sir, as I predicted on Wednesday or Thursday (sorry, last week was like crazy hell for me, very little sleep, very stressful, and almost no time for my young kids), the charity's leaderhip could not make a decision before the weekend. As predicted they asked me to ask you to delay reply until after the weekend (Monday afternoon), as well as to seek, if possible, additional discount to 1M. I told them, bluntly, that I'm not sure about additional discount, becasue from what I understood from you, what your boss already approved was beyond the ususal discount you give. I left board meeting really frustrated, first of all on a personal level, due to the fact that I thought I will have a quite weekend, handing over our correspondance to the person who will take care of execution and buying the XMR, but also because I have no face to disspoint you. I know that you expect an answer, and I feel bad that I can't deliver any positive results at the moment. I need to ask you for an extension. I'll be here to reply to all your notes, to provide you with any background information you need, and even if you want to exchange weekend receipies. Board and trustees will reconvene after the weekend, on Monday morning, and on the positive side, it gives me time to talk and to be successful in persuading them to complete the deal in order to recover all systems by Tuesady/Wednesdy. Thanks in advance for you understandging. I really appreciate it. Respectfully, [redacted].

Thank a lot, Sir, for understanding. I will be in close touch also during the weekend. Best and have good night. Tell your boss that you deserve some time off and a good drink. Emilie

Please also update the countdown of the clock at the bottom of our corresponding page? Thanks, Emilie.

Ok, maybe I'm a bit confused. I trust you. Good night Sir.

Good evening Sir. I hope that you took some time off to be with your family. I'm here to answer any question. Respectfully, [redacted].

Good evening Sir. The IT team have sent me a file, which they kindly ask you to decrypt in order to see, as mentioned in your early note and here on this website, the the decryption tool actually work. I will try to attach it now. Respectfully, [redacted].

Good morning Sir, I could not sleep the whole night. Thanks for the file, I'll be in touch later this morning. Thanks, [redacted].

This was written couple of hours ago, but apparently there was a fault in your system and it was sent just now.

Thanks, I'm here. I would like to ask you, first, informally (before I speak to "my" trustee in the board). Is there any chance that you will be able to extend the deadline for Wednesday evening? The reason I'm asking is because there was some government move to our senior leadership, and I'm afraid that they were asked not to pay. I can tell you that the majority of board members want to complete the deal, as it's the only way they can restore the system, but it seems that the weekend brought with it also pressure in the opposite direction. Would love to hear your boss opinion on that. Respectfully, [redacted]

This is why I'm checking with you Sir. The board of the charity is meeting in 1:30 hours, (2 PM GMT), and I want to bring them the most updated information from you. At the moment, you were kindly offering the charity to pay 1.5M and deadline is tonight. If I could get an extra "stretch" (as you wrote) to pay 1M, and deadline is Wednesday morning, that would have been very helpful to get the board and trustees approval, despite any other external voices. Please bring it to the boss approval. Anything of this will make my mission more likely to succeed. Thanks in advance, [redacted].

I understand. May I speak with the boss? Can he come to the chat? Can I give him an email address?

Please, you can't leave me with this answer. I see that boss can't do Wednesday, and I understand his and your perspective. Will it be possible to leave price as it is, and give time decision time until Tuesday night? If it was not this external inputs, I'm confident that I could have sort it out by myself. Thanks, [redacted]

Please reply Sir, I'll be back in an hour. Need to go and prepare for board meeting. A women, you know.

I see, Sir. I can't ask more, and I don't beg. If you can extend the deadline until Tuesday - it will be helpful with the board in 5 minuets. If you are not interested - I will not be happy with it, as it will be more difficult for me to persuade board and trustees to complete the deal, but - I will understand. As said, I'm a woman who respects herself and her partners. I will not beg. Respectfully, [redacted]

So Sir, what are my option, currently??

My options, I mean. 1.5M until tonight or 2.4M until Wednesday? Or can you do 1.5M until Tuesday 2PM GMT? Best, Emilie

Thanks Sir. I appreciate it. A lot. Please convey my thanks to your boss. Respectfully, Emilie.

Good morning, Sir. I see. Thanks for sharing. I'll revert soon. Emilie

I know Sir. I can't ask for more time. There is no decision yet, on behalf of the board and the trustees. The situation has turned to be too complex, and I hope that a positive decision will be taken in the next couple of hours. I predicted that, and this is the reason for asking for the Wednesday deadline, however I fully understand your view point. I'll come back once I have news. Respectfully, [redacted].

Sir, I have no news. I wish I could solve this matter. I wish. I predicted the dynamics in the charity, this is why I asked for Wednesday, and 1M. There is nothing I can do now, apart from praying that your boss will give me more time. But if it puts you, personally, at risk, please don't ask. Yours, [redacted].

Sir, I want to be honest. I don't know now. I just don't know what the decision will be. They are discussing, elaborating, trying to find understanding and sources of fund to pay. It is completely your decision Sir. I can't ask for more. You were very generous, and I hope one day will come I could reciprocate. [redacted].

As said, it's your call. You are more experienced than me in this business, and I'm familiar with the decision making process here. Publication will most likely discourage charity's leadership to pay anything. But again, you have the finger on the control button. Hope you'll take the right one. [redacted].

Starts at 14:00 London time. Sir.

Hope to have an answer by 17:00 GMT. If not a definitive answer, at least a positive indication, Sir.

I guess the latter Sir. This will not be dragged by Thursday, I believe.

Im here Sir. Waiting for you.

I'll check your decision in couple of hours Sir. I must leave this computer and go home to my family. Respectfully, [redacted].

Sir, I thank you and your boss, however I'm a bit confused by your message. First, my colleagues are informed on all our communication. I understand about the publication, and the sample publication you sent me earlier is what stirred the debate among the trustees, as I predicted. Second, what do you mean the attack will continue? Is this kind of a terminology you use to persuade people? Thanks for understanding, [redacted].

So, am I right to understand that you still have assets and access to the network? If yes, I need to inform the leadership as this change their discussions tomorrow. What type of access you have? Thanks, [redacted].

Yes. I thought that this will be your answer. I'm too exhausted to comment. Thanks and have a good night. [redacted].

Sir, good evening. No news. Significant and powerful external forces are involved at the moment. No decision has been made. I don't know to say when. I'm asking for nothing. Just humbly informing you of the current state of affairs. Sorry for that. [redacted].

Not mine, Sir. I'm doing my best. [redacted].

I will pass this message Sir.

Good morning Sir. I understand very well what is happening. And I probably failed to explain what was going on at the board meetings. [redacted] charity is not a private company, many stakeholders involved. Unfortunately. [redacted].