// Context
About This Negotiation
This transcript documents a REvil ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 67 messages exchanged over Unknown.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — 17 days ago — Message 1/67
hi
[Victim] — 17 days ago — Message 2/67
can you open these files?
[Victim] — 17 days ago — Message 3/67
your note says you have our files in "secure offline storage", what files do you actually have?
[REvil] — 17 days ago — Message 4/67
Hi
[REvil] — 17 days ago — Message 5/67
proof-
[Victim] — 17 days ago — Message 6/67
this is everything you have?
[REvil] — 17 days ago — Message 7/67
about 5 GB of files with your recipes, customer data and much more
[REvil] — 17 days ago — Message 8/67
file
[REvil] — 17 days ago — Message 9/67
file
[Victim] — 16 days ago — Message 10/67
Thanks for this. Is there any chance you can send more files? Asking
for $120k and only showing 6 files is not really convincing the owners
[REvil] — 16 days ago — Message 11/67
as we said, this is a small part of the data, we will not discard all
the data that we have. But after payment we will delete all copies of
the data
[Victim] — 15 days ago — Message 12/67
Thank you for sharing these files too. Do you allow any kind of discount for payment?
[REvil] — 15 days ago — Message 13/67
15% discount max
[Victim] — 15 days ago — Message 14/67
So $102,000? This is the lowest price?
[REvil] — 15 days ago — Message 15/67
Yes
[Victim] — 14 days ago — Message 16/67
We have a meeting coming up in a few hours to figure out what we can offer. I will update you after that
[REvil] — 14 days ago — Message 17/67
we dont need to know how much you offer - you already see price
[Victim] — 14 days ago — Message 18/67
We dont have $102k today and we wont have it tomorrow. I still want our files back so I am trying to find a solution.
[REvil] — 14 days ago — Message 19/67
then you need to collect it
[Victim] — 13 days ago — Message 20/67
Well we need time to see what can happen. Everything is closed for the weekend so can you push this clock a few more days?
[REvil] — 13 days ago — Message 21/67
Is 2 days enough for you?
[Victim] — 13 days ago — Message 22/67
Can we get until Tuesday to sort this out?
[REvil] — 13 days ago — Message 23/67
to much time - we can expend timer only until monday
[Victim] — 12 days ago — Message 24/67
Can you at least extend it to the end of the day tomorrow? Everything
is closed since it's the weekend and we won't be able to get anything
done until tomorrow.
[REvil] — 12 days ago — Message 25/67
ok
[Victim] — 11 days ago — Message 26/67
Thanks, the timer expired it seems but I will get back to you later this afternoon
[Victim] — 11 days ago — Message 27/67
The amount you're asking from us given our size and revenue is just way
off base and we're struggling to see how this number was determined.
Obviously you got into our systems and got some of our files, but we
can't make this large of a payment. I can honestly pay you $8,775 and
even that is really stretching it
[REvil] — 11 days ago — Message 28/67
dont waste our time
[Victim] — 11 days ago — Message 29/67
How am I wasting your time? This is a real offer. Our revenue has been
down 70% since last year, we don't have the ability to pay over $100k
[REvil] — 11 days ago — Message 30/67
We are not interested in this.
We have indicated the amount for you.
Your proposal sounds stupid.
If you are not willing to pay more.
bye
[Victim] — 11 days ago — Message 31/67
We both know we're not able to pay $100k. What is a better price that
we can work toward? I can't shell out 6 figures, we will lose our
business
[REvil] — 11 days ago — Message 32/67
90k our last price
[REvil] — 11 days ago — Message 33/67
not lower
[Victim] — 11 days ago — Message 34/67
That's a really big gap between what we have vs. 90k. I'll need a few
days to get my finances in order and see if we can make something work
[REvil] — 11 days ago — Message 35/67
ok
[REvil] — 8 days ago — Message 36/67
news?
[Victim] — 8 days ago — Message 37/67
I'm not even close to $90k yet, but looking into something tomorrow. I will update you tomorrow okay?
[REvil] — 8 days ago — Message 38/67
ok
[Victim] — 7 days ago — Message 39/67
Could you please send a couple more example files of the data you have?
I'm working to get a bit more cash today and should have an answer for
you in a couple of hours
[REvil] — 7 days ago — Message 40/67
wait for answer
[REvil] — 7 days ago — Message 41/67
proof 3
[Victim] — 7 days ago — Message 42/67
Thanks
[Victim] — 7 days ago — Message 43/67
I don't know where you are in the world, but Alaska relies heavily on
tourism for revenue. With 2020/COVID, no travel to Alaska was permitted,
so we lost ~30% of sales revenue from this. No one was buying our
product, even through the summer months (which is usually high time for
tourists). Without these tourists, we really struggled to make ends
meet. I'm making slow progress to get extra cash, the most I have right
now is $12,825
[REvil] — 7 days ago — Message 44/67
not interested
[REvil] — 7 days ago — Message 45/67
make a really interested offer for my boss
[Victim] — 7 days ago — Message 46/67
We'll never have $90k, please help me out on this. What I'm offering is
a lot for a small business owner like myself, I don't have the kind of
cash flow like other years. Talk to your boss for me please
[REvil] — 7 days ago — Message 47/67
my boss can offer 20% discount
[REvil] — 4 days ago — Message 48/67
hello , are you ready for dialogue ?
[Victim] — 4 days ago — Message 49/67
Sorry we had issues reaching your site over the weekend but I'm here
[Victim] — 4 days ago — Message 50/67
20% discount off the $90,000? So this would be $72,000?
[REvil] — 4 days ago — Message 51/67
yes
[Victim] — 4 days ago — Message 52/67
I only have about $13,000 right now
[REvil] — 4 days ago — Message 53/67
then you need to collect money
[Victim] — 4 days ago — Message 54/67
I don't think I can ever get 70k, that's more than I make in a year
[Victim] — 3 days ago — Message 55/67
Any chance you can wait for next week and I should have a bit more ?
[REvil] — 3 days ago — Message 56/67
You ask for too much time
[Victim] — 3 days ago — Message 57/67
I don't have $70k
[Victim] — 3 days ago — Message 58/67
Can you wait for Friday then?
[REvil] — 3 days ago — Message 59/67
friday its last day for you
[REvil] — 22 hours ago — Message 60/67
hello, are you ready to pay ?
[Victim] — 19 hours ago — Message 61/67
Hi, I don't have the entire amount, it's really not something I can easily get. Today I have $15,300
[Victim] — 19 hours ago — Message 62/67
Can we agree to that?
[REvil] — 19 hours ago — Message 63/67
wait for answer
[REvil] — 17 hours ago — Message 64/67
ok
[Victim] — 17 hours ago — Message 65/67
You agree to this?
[REvil] — 15 hours ago — Message 66/67
yes
[Victim] — 13 hours ago — Message 67/67
Okay I can do it on Monday thanks