// Context
About This Negotiation
This transcript documents a REvil ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 52 messages exchanged over Unknown.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — 23 days ago — Message 1/52
Hello, are you a live person
[REvil] — 23 days ago — Message 2/52
Hello , yes
[Victim] — 23 days ago — Message 3/52
what can we do if we dont have this much money?
[Victim] — 23 days ago — Message 4/52
because we dont have $100,000
[REvil] — 23 days ago — Message 5/52
My boss can offer 10% discount for fast payment
[Victim] — 23 days ago — Message 6/52
we dont even have this money to pay in 3 days, we would have to get loans or other means of payment.
[REvil] — 23 days ago — Message 7/52
We can add time
[REvil] — 23 days ago — Message 8/52
how much time do you need ?
[Victim] — 23 days ago — Message 9/52
even if we get it, we have to buy monero and that takes time to clear
the funds, it takes weeks to get validated with any exchange.
[REvil] — 23 days ago — Message 10/52
binance.com - 1 day
[Victim] — 23 days ago — Message 11/52
why is this much?
[Victim] — 23 days ago — Message 12/52
why is it this much?
[REvil] — 23 days ago — Message 13/52
The price depends on your income
[Victim] — 23 days ago — Message 14/52
My income is only 10,000 a month. Its in the system it shows it that way
[REvil] — 23 days ago — Message 15/52
You work for a company, don't bluff with us
[Victim] — 23 days ago — Message 16/52
yea, i am the owner. the company is mine. Im not bluffing. I make 120k a
year and 10k a month I work for the company. this is [redacted] service
company. Our service call charge is $75 per service call. How can I pay a
100,000?
[REvil] — 23 days ago — Message 17/52
My boss can offer 10% discount
[Victim] — 23 days ago — Message 18/52
i understand and thank you but we need more of a discount
[Victim] — 23 days ago — Message 19/52
i simply cannot afford 90-100k
[Victim] — 23 days ago — Message 20/52
what guarantee do i have that my system will start working after i do what you ask for
[REvil] — 23 days ago — Message 21/52
check our name in web
[Victim] — 23 days ago — Message 22/52
I dont know this things. im just a [redacted]. Im asking a friend to look in to it.
[Victim] — 23 days ago — Message 23/52
I have to borrow money from friends. So give time so i can see what i can get
[REvil] — 23 days ago — Message 24/52
Okay
[Victim] — 23 days ago — Message 25/52
So I was able to get 35,000.00 so far from friends which i have now. I
understand this is your job and what your demanding so i can have mine
back. I respect that even when i don't.
But I checked your web and there are no guarantees.
I have family and i work for this money, so loosing it is not an option
for me. I need some type guarantee so i know your the guy and i wont be
lied to and loose the money
[REvil] — 23 days ago — Message 26/52
You can try trial decryption to make sure we unblock everything
[Victim] — 17 days ago — Message 27/52
You messed up my entire work and life. The only way I will pay you is
to be 100% sure you will release the files after I pay you.
The only way you can prove me is I will pay 10,000.00 for 1 specific database file. If you agree let me know.
And I don't know if that is also possible,
I don't have any guarantee from you.
[REvil] — 17 days ago — Message 28/52
We can agree to 35k and we guarantee that you will be able to decrypt all your files
[Victim] — 10 days ago — Message 29/52
Hello
[Victim] — 10 days ago — Message 30/52
We had 70% back up and i was able to hire IT guys to build me a new
system and restore 70% of my data. I spent 12,250.00 for this and I
don't have anymore the 35,000.00
I am willing to pay the balance to you to get the remaining data so I can continue with my life.
Let me know what you want to do. I will wait on you.
took long to get back to you as we were busy building a new system
[REvil] — 10 days ago — Message 31/52
These are just your problems.
Nobody made you pay other teams to get well.
Our decryptor completed this in a few hours.
20% discount is all that we are ready to offer
[Victim] — 9 days ago — Message 32/52
you made this problem for me.
Ok, I dont have the money. I am working on a job and will get paid in 2
weeks at most . so let me get the money together and will get back to
pay.
[Victim] — 9 days ago — Message 33/52
28,000.00 correct ?
[Victim] — 9 days ago — Message 34/52
I have 22,750.00 now. Let make the deal and move forward please. This is hard for me
[REvil] — 9 days ago — Message 35/52
price update you can pay
[Victim] — 8 days ago — Message 36/52
I dont understand what your saying ?
[REvil] — 8 days ago — Message 37/52
Nothing
[Victim] — 8 days ago — Message 38/52
I have to go to work. leave the answer when i get back tonight i will contact
[Victim] — 8 days ago — Message 39/52
R u asking what i can pay ?
[REvil] — 8 days ago — Message 40/52
are you ready to pay ?
[Victim] — 8 days ago — Message 41/52
Yes
[Victim] — 8 days ago — Message 42/52
I already transferred 22,750.00 to my friends account today to help me
send the money or xmr to you. I dont know this things how they work. We
have to purchase it and send it to you
[Victim] — 8 days ago — Message 43/52
also monero price is 273.97 today not 82.52
[REvil] — 8 days ago — Message 44/52
price fixed
[Victim] — 7 days ago — Message 45/52
when will i get the code after i pay
[REvil] — 7 days ago — Message 46/52
30 minutes
[Victim] — 3 days ago — Message 47/52
Hi, I just sent money to a friends account. He will transfer to his
bianca account to purchase monero and send it to you. I instructed him
not to send the full amount. He will send an amount and you have to
check and let me know that number so i can make sure its coming to you
and I will have him send the remaining balance.
[Victim] — 3 days ago — Message 48/52
should be done in few days
[REvil] — 3 days ago — Message 49/52
ok
[Victim] — 9 hours ago — Message 50/52
we're almost done sending the first payment. Binance.us doenst support
monero, and neither does kucoin or coinbase. I had to buy litecoin on
coinbase, send it to cakewallet, and Im using that the convert to
monero. Maybe will take a few hours.
[Victim] — 5 hours ago — Message 51/52
Just sent to the monero address above. Verify how much it is and let me know.
[REvil] — 4 hours ago — Message 52/52
5 monero receive