// Ransomware Negotiation Transcript
REvil Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a REvil ransomware negotiation with a redacted victim organisation. The negotiation consisted of 23 messages exchanged.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
How can i trust that if i pay, you will provide the decryptor? How long
does the process take to get the decrpytor and how long then will it
take me to decrypt the files?
Hello. The decryptor is obtained automatically after payment.
Also, you can read about us in the internet who we are, there enough information that will get you out of any doubt.
Some of the read me files have different text in them, will the decyptor decrypt them all?
Yes.
Hello
Hi, how can be sure if payment is made that the decrypting software will be provided?
We value our reputation and we have proved ourselves over a long period
of time. We have a 100% guarantee after the transaction is completed
that you will receive the decryptor and your data and information about
you will be immediately deleted.
Can I upload you a file to prove that you can decrypt it?
Yes
Here is the file
File
Yes it works. I will try to find a way to buy xmr.
Or u can simply buy monero on this exchanges and withdraw on ur own wallet and send to us.
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]
and there are all of the ways to get monero
[REDACTED URL]
Now I see that some of the files are deleted. How to restore them?
All this exchanges that you sent require a lot of time to transfer fiat
and buy XMR on them. I'm trying to find a faster way. Can you postpone
the time for payment a little bit?
Okay , we added.
Ok thanks
Waiting for 10 confirmations by Monero system, it takes ~30 min
We just paid
Ok, now I have access to decryptor. But when I log on to the machine it
is locked and there is a screen to enter password, what is it?
password- [redacted]
it works thanks
// Analysis
Analyst Observations
- REvil (also known as Sodinokibi) was responsible for high-profile attacks including Kaseya and JBS. The group was disrupted by law enforcement in late 2021 and early 2022.