// Context
About This Negotiation
This transcript documents a REvil ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 132 messages exchanged over Unknown.
The initial ransom demand was $1.0M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[REvil] — 1 month ago — Message 1/132
Hello,
We are REvil Group.
We want to inform that your company local network have been hacked and
encrypted. We have all your local network data. The Price to unlock is
$1,000,000. Now we're keeping it a secret, but if you do not reply us
within 3 days it will be posted on our news-site. Think about the
financial damage to your stock price from this publication. In case of
successful negotiations we guarantee that you will get decryptors for
all your machines, non recoverable removal of downloaded data and
security report on how you were hacked to fix your vulnerabilities. We
hope that you can correctly assess the risks for your company.
You can find more information about REvil group in Google.
Posting on our blog and further publications in the media will lead to
significant losses for your company: court and government fines, data
recovery, loss of reputation, abandonment of clients, drop in limits.
But don't panic! We are in business, not in war.
We can unblock your data and keep everything secret. All we need is a ransom.
In this case, you also get: a security report, a complete tree of
compromised data files, permanently deleting downloaded data, support
with tips on unlocking and protecting.
[Victim] — 1 month ago — Message 2/132
Okay. I appreciate your introduction. My name is [redacted] and I'm part of
the IT team here. My manager is asking if you can show us all of the
data that you took?
[REvil] — 1 month ago — Message 3/132
You will receive complete data only after payment. We can only give an example of the data taken.
[Victim] — 1 month ago — Message 4/132
Okay. That may work for now. How long does that example take to get from you?
[REvil] — 1 month ago — Message 5/132
from several hours to a day
[REvil] — 1 month ago — Message 6/132
wait for answer.
[Victim] — 1 month ago — Message 7/132
Are you here?
[REvil] — 1 month ago — Message 8/132
Yes
[Victim] — 1 month ago — Message 9/132
Will you share the example data today?
[REvil] — 1 month ago — Message 10/132
We need time.
You are not the only one who needs to provide evidence of a break-in
[Victim] — 1 month ago — Message 11/132
Okay. Can we discuss this price then? We're a non-profit organization
with the majority of services covered by tax payers/state government. We
help treat a variety of patients from cancer to mental health. It's
very important we get our systems back quickly. My manager said we can
promise you an almost immediate payment, but not at $1M. It would be
impossible
[REvil] — 1 month ago — Message 12/132
In case of quick payment, we are ready to offer you a 20% discount
[Victim] — 1 month ago — Message 13/132
This is generous, my manager is happy to know you are willing to help
us with the price. He thinks even still 20% is too much for us to be
able to pay, but said they will discuss it when everyone else is online
again. Please send the example files whenever you have them
[REvil] — 1 month ago — Message 14/132
We are working on it. But you can also make your proposal and my boss will consider it.
[Victim] — 1 month ago — Message 15/132
Okay. My manager is willing to make a proposal after we receive the files, so I will keep an eye out for your update.
[Victim] — 1 month ago — Message 16/132
Any luck with getting the files so that I can share with my manager?
The sooner I send them the files, the sooner we can talk about coming to
an agreement.
[REvil] — 1 month ago — Message 17/132
Part of random lines from the tree file
[Victim] — 1 month ago — Message 18/132
Thank you. Can you send me these files? [redacted]passport.pdf, mandatoryreport.docx and [redacted].pdf
[REvil] — 1 month ago — Message 19/132
file
[Victim] — 1 month ago — Message 20/132
You can send the other 2 also?
[REvil] — 1 month ago — Message 21/132
yes wait
[Victim] — 1 month ago — Message 22/132
Okay thank you
[REvil] — 1 month ago — Message 23/132
file
[REvil] — 1 month ago — Message 24/132
file
[Victim] — 1 month ago — Message 25/132
Thank you I will be right back
[Victim] — 1 month ago — Message 26/132
We'd like to move very quickly with you. Given what we do, it's
important we have your decryptor as soon as possible to get our systems
back so we can keep helping patients. We can't afford the price you
indicate on the site, but we can pay you $195,000 today. We already
started the wire process to a broker in the US so that it arrives
immediately
[REvil] — 1 month ago — Message 27/132
20% discount its all.
[Victim] — 1 month ago — Message 28/132
We can't make that happen. We don't have that kind of funding. Please
think this over, we really need our data back and you're the only one
who can help us with that.
[REvil] — 1 month ago — Message 29/132
Your offer is too small
[Victim] — 1 month ago — Message 30/132
What do you propose then? Please understand the circumstances we are
in. Everything is shut down, we can't help our patients. Everyday we are
down, the worse off we are. We need to purchase the tool quickly and in
good faith, already hired a broker in the US to assist us and sent him
some funds so he can buy crypto quickly for you.
[Victim] — 1 month ago — Message 31/132
It's very late here already, I've been working all day but will stay up
all night if it means we can have a compromise with you today
[REvil] — 1 month ago — Message 32/132
We have been administrators of your network for a long time and we know
how much you are willing to pay. Our latest offer is 700k but that's
all
[REvil] — 1 month ago — Message 33/132
Our servers have hundreds of gigabytes of your confidential data. You must understand the seriousness of the situation.
[Victim] — 1 month ago — Message 34/132
If that is true then you would have seen we are just a non-profit and
don't have millions. We don't operate like large companies. Any money we
get comes from donations or the government and is used to provide our
services. We have many expenses and a low budget. Please understand that
even something like $500,000 is a lot of money for us and we can't make
that happen. WIth COVID we weren't able to have as many
events/fundraisers as usually. These are the drivers of our income, it's
been a difficult time for us, everyone really. I can certainly check
with the board on what else we can do, but will need to wake some of
them so please wait. We seriously need to be back today
[REvil] — 1 month ago — Message 35/132
We can wait, but ours, we gave you the last sentence
[Victim] — 1 month ago — Message 36/132
Are you the owner for REvil?
[Victim] — 1 month ago — Message 37/132
If you are, please find it in your heart to help us here. We'll never
have $700k and I will do what I can to figure out where to pull money
from, but we need help
[REvil] — 1 month ago — Message 38/132
no , support.
[Victim] — 1 month ago — Message 39/132
Okay I got in touch with some of the board, they want me to express how
important it is that we reach an agreement today. We don't have time to
waste and I can pay you immediately. We have confirmation the US broker
received our money transfer. The budget we have is fixed annually so we
can't reallocate funding. The board was able to connect with a partner
that committed to donating sooner than normal. We can pay you $255k
right now. Thank you
[REvil] — 1 month ago — Message 40/132
We have too much sensitive data to accept such a low offer.
650k and we agree
[Victim] — 1 month ago — Message 41/132
It's impossible. It would take months for us to get that kind of money.
Please think on our offer. Please discuss with your team internally.
This is very serious for us and we need to pay you today. We have no
other way to get money. We were lucky to find the partner to help us out
this time
[REvil] — 1 month ago — Message 42/132
You should make an offer above otherwise we will not be able to agree
[Victim] — 1 month ago — Message 43/132
I don't think we can get much more than what we offered. Please talk to
your team/boss and let me know. $650k is impossible, $500k is
impossible. We are 100% ready to pay you immediately. I will be here
until the job is done.
[REvil] — 1 month ago — Message 44/132
Then we will not be able to agree
[Victim] — 1 month ago — Message 45/132
Did you talk to them and explain the scenario? We're doing everything
we can here and are ready to pay asap. I'm sure you have much larger
clients that can pay this kind of amount, but that's not us. We don't
want to waste any more of your time on this, I'm sure you are talking to
many people like me at the same time. Please reconsider our offer and
see if you can accept something closer to what we offered!
[REvil] — 1 month ago — Message 46/132
650 is the last thing my boss has to offer. The price for selling your data will be much higher
[Victim] — 1 month ago — Message 47/132
We can never do it! The original asking price was set too high for us.
You have our files and like you said, were on our systems for a while. I
don't doubt this at all. You can check our files/systems and see we
never had this kind of money. DId you tell your boss we can pay you
right now??
[REvil] — 1 month ago — Message 48/132
I passed the information directly to the boss and everything he has to offer 650k
[Victim] — 1 month ago — Message 49/132
I just called the broker company helping us with payment and they said
good things about you and historically REvil has given much larger
discounts than 35%. Please if you can offer a better price we will do
our best to figure this out. It's very late here, I'm very tired but
need to get this completed
[REvil] — 1 month ago — Message 50/132
If you are willing to pay quickly, we will approve the amount of 600k. But this is only in case of quick payment.
[Victim] — 1 month ago — Message 51/132
But we only have $255k. HOw are we supposed to get more money? It's
very early morning here, everything is closed. I need to have this done
before business hours. We were lucky the partner was still available and
offered to help. We don't have any more options
[REvil] — 1 month ago — Message 52/132
We cannot offer any other solution to the problem. We can wait there is no problem.
[REvil] — 1 month ago — Message 53/132
We are ready to consider options for a deferred payment if you pay 300k
now and receive a decryptor and 300k the next day for non-dissemination
of your data.
[REvil] — 1 month ago — Message 54/132
This is really the last thing we can offer
[Victim] — 1 month ago — Message 55/132
If we wait any longer, we incur major risks
[Victim] — 1 month ago — Message 56/132
I don't have $300k and then another
[REvil] — 1 month ago — Message 57/132
Then we will not be able to agree
[Victim] — 1 month ago — Message 58/132
This is really disappointing. We're making great strides to fix this with you
[REvil] — 1 month ago — Message 59/132
We are ready to consider options for a deferred payment if you pay 255k
now and receive a decryptor and 355k the next day for non-dissemination
of your data.
[REvil] — 1 month ago — Message 60/132
Its all !
[Victim] — 1 month ago — Message 61/132
We can't!! How do I get $355k out of nowhere? We might be able to get a
few more thousand dollars but definitely not $355k. I think the most we
can actually send you is $284,811.29. THis is what we wired to the
broker and he can purchase the crypto. His own fee is included in that
amount but I think I can ask him to hold off on charging that so the
full amount is yours okay? Please let me call him and ask this. It is
only the afternoon where he is so it should be fast
[Victim] — 1 month ago — Message 62/132
He agreed to help, which means the full amount we sent can go to you today. Please let me know!
[REvil] — 1 month ago — Message 63/132
300 and okay
[REvil] — 1 month ago — Message 64/132
price update you can pay.
[Victim] — 1 month ago — Message 65/132
Thank you!! We will figure out the remaining amount, but I think this is possible. Thank you so much
[Victim] — 1 month ago — Message 66/132
Can you unlock this? We don't have a picture to use
[REvil] — 1 month ago — Message 67/132
file
[Victim] — 1 month ago — Message 68/132
Thank you!!
[Victim] — 1 month ago — Message 69/132
Can you confirm what we will receive today after we pay you $300k?
[Victim] — 1 month ago — Message 70/132
Are you here?
[REvil] — 1 month ago — Message 71/132
After payment you receive:
- Universal decryptor for your all network
- The complete deletion of all your files with our warranty not to use the data for any purpose.
- 100% confidentiality of this incident and all terms of the transaction on our part.
- Complete audit of your network to prevent similar attacks in the future
[Victim] — 1 month ago — Message 72/132
Ok thank you for sending over this confirmation for me! I am working on
sending payment, I will send you a confirmation here once it goes
through. But I can only pay in bitcoin, where do I send it?
[Victim] — 1 month ago — Message 73/132
Are you here? Please confirm where I should send the bitcoin.
[Victim] — 1 month ago — Message 74/132
Are you here?
[REvil] — 1 month ago — Message 75/132
You can use Bitcoin instead of Monero, but it will be more expensive for you in case of our merchant additional fee,
so if u want to pay in BTC u need to add +10%. Or u can simply buy
monero on this exchanges and withdraw on ur own wallet and send to us.
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]
and there are all of the ways to get monero
[REDACTED URL]
[REvil] — 1 month ago — Message 76/132
btc enabled update
[Victim] — 1 month ago — Message 77/132
We can only pay in bitcoin because that's the only payment method the
broker will help us with. We are giving you everything that we can to
just reach $300k. We are ready to pay you quickly but we don't have an
extra $30k to give you. Please, can we just pay the $300k that we agreed
to in bitcoin so we can pay you quickly.
[REvil] — 1 month ago — Message 78/132
10% commission is charged by our payment processor, we have nothing to do with this money.
Below 300k we will not accept
[Victim] — 1 month ago — Message 79/132
Are you ableto make the price $270k and then with the 10% it equals all
of the $300k? We don't have another $30k. Some of us are going to max
our credit card to get near the $300k you're asking. We really can't
make another $30k happen and the broker in the US said its illegal to
pay in monero, this is why it must be bticoins please
[REvil] — 1 month ago — Message 80/132
There is nothing we can do to help.
Our latest offer is 300k. If not, we will simply publish your details.
We made maximum concessions
[Victim] — 1 month ago — Message 81/132
Come on mate please help me out, we came this far. The broker said
majority of the time you waive the 10%. I don't want to waste anymore of
your time on this with me, let's just be done. I can't get any more
money
[REvil] — 1 month ago — Message 82/132
not interested.
[Victim] — 1 month ago — Message 83/132
You're going to turn us away over 10%? What is this even for?
[REvil] — 1 month ago — Message 84/132
After 12 hours, the amount will return to 1kk
[Victim] — 1 month ago — Message 85/132
I need to know why you add the 10%, I can't just ask someone for $30k with no explanation
[REvil] — 1 month ago — Message 86/132
I repeat bitcoin transactions are tracked and the payment gateway takes a commission to clear them
[Victim] — 1 month ago — Message 87/132
They charge you 10% when you try to clear it ? Or is it a small % and you are adding more? Can we agree on 3% ?
[REvil] — 1 month ago — Message 88/132
no
[Victim] — 1 month ago — Message 89/132
You're killing me!!
[REvil] — 1 month ago — Message 90/132
Our agreement 300k will not be lower
[Victim] — 1 month ago — Message 91/132
We agree with $300k, but youre trying to add another $30k and we don't
have any way to make that happen. We can only send you exactly $300k in
bitcoin, you won't get less than this!
[REvil] — 1 month ago — Message 92/132
Then pay in Monero 300k
[Victim] — 1 month ago — Message 93/132
It's illegal!
[REvil] — 1 month ago — Message 94/132
These are not our problems
[REvil] — 1 month ago — Message 95/132
If you need decryptor pay.
[Victim] — 1 month ago — Message 96/132
Why do you ask for payment in a currency the US can't pay ?
[REvil] — 1 month ago — Message 97/132
If you keep asking stupid questions, you will be banned from this chat.
Either you pay, or we publish your data in the media with the subsequent sale, you must pass this information to your boss.
[Victim] — 1 month ago — Message 98/132
He understands, we're trying to figure it out. There's no way to make
the 10% lower?? Also he wants to know if you will let us download all
the files you took from us after payment
[REvil] — 1 month ago — Message 99/132
We provide a complete file tree for complete confidentiality after
payment arrives at our account, the data is automatically deleted along
with the server.
[Victim] — 1 month ago — Message 100/132
Okay we 100% would like the file tree before you delete the files. But
if there is any way we can download the files before you delete them,
that would be preffered. Is that possible at all?
[REvil] — 1 month ago — Message 101/132
No, this violates our privacy policy.
[REvil] — 1 month ago — Message 102/132
Only file tree
[Victim] — 1 month ago — Message 103/132
Okay thank you. Some people are just getting online now, so I will let you know soon on the payment
[REvil] — 1 month ago — Message 104/132
OKay
[Victim] — 1 month ago — Message 105/132
Can you lock the amount to be 6.0027 BTC so we can purchase the right
amount without having to go back to our vendor multiple times?
[REvil] — 1 month ago — Message 106/132
Ok
[Victim] — 1 month ago — Message 107/132
Sorry our US broker hasn't been responsive, but I think that is because
of the time zone. Can we still pay you in a few hours when they are
online? I did not expect this to happen, but wanted to let you know that
everything is set, I am just waiting on them
[REvil] — 1 month ago — Message 108/132
No problem
[Victim] — 1 month ago — Message 109/132
Thank you very much! I appreciate your help.
[Victim] — 1 month ago — Message 110/132
we have paid
[REvil] — 1 month ago — Message 111/132
Okay wait 3 confirmations
[Victim] — 1 month ago — Message 112/132
Please send us universal decryptor now that there are 3 confirms. Thank you
[REvil] — 1 month ago — Message 113/132
To use a decryptor run it as administrator and turn off antivirus before.
You can use a decryptor as gui application or through cmd.
CMD commands:
UniversalDecryptor.exe -full
UniversalDecryptor.exe -path "C:\folder"
UniversalDecryptor.exe -file "C:\folder\file.txt.random_ext"
* decryptor with -full option will decrypt all with default params.
If you use it as gui application, mI recommend you choose "create
backups" option. If you use decryptor without this option, you should
not interrupt decryption process, otherwise some files will be
irreversibly damaged.
[Victim] — 1 month ago — Message 114/132
Thank you, please send us the file tree as well?
[REvil] — 1 month ago — Message 115/132
file
[Victim] — 1 month ago — Message 116/132
please confirm all files are deleted?
[Victim] — 1 day ago — Message 117/132
Hi are you there?
[REvil] — 1 day ago — Message 118/132
all files was deleted
[Victim] — 1 day ago — Message 119/132
there is some issue and need your help
[Victim] — 1 day ago — Message 120/132
??
[REvil] — 1 day ago — Message 121/132
?.
[Victim] — 1 day ago — Message 122/132
Can you please provide the invoice??
[REvil] — 1 day ago — Message 123/132
We do not issue invoices
[Victim] — 1 day ago — Message 124/132
any other method please??
[Victim] — 1 day ago — Message 125/132
Please understand I will lost my job.. Higher management is asking for it.
[REvil] — 1 day ago — Message 126/132
wait for answer.
[Victim] — 1 day ago — Message 127/132
ok I am waiting Thanks
[Victim] — 1 day ago — Message 128/132
Please help me fast please it's a humble request.. Higher management is keep pinging me & asking for it
[Victim] — 1 day ago — Message 129/132
It's about my job please understand. I don't want to lose my job. I
have my loans and debts which I have to pay. Please help me fast
[Victim] — 1 day ago — Message 130/132
are you there???
[Victim] — 1 day ago — Message 131/132
kindly reply me.. please understand my situation
[REvil] — 1 day ago — Message 132/132
wait for answer