// Ransomware Negotiation Transcript
REvil Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a REvil ransomware negotiation with a redacted victim organisation. The negotiation consisted of 67 messages exchanged.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
hi
can you open these files?
your note says you have our files in "secure offline storage", what files do you actually have?
Hi
proof-
this is everything you have?
about 5 GB of files with your recipes, customer data and much more
file
file
Thanks for this. Is there any chance you can send more files? Asking
for $120k and only showing 6 files is not really convincing the owners
as we said, this is a small part of the data, we will not discard all
the data that we have. But after payment we will delete all copies of
the data
Thank you for sharing these files too. Do you allow any kind of discount for payment?
15% discount max
So $102,000? This is the lowest price?
Yes
We have a meeting coming up in a few hours to figure out what we can offer. I will update you after that
we dont need to know how much you offer - you already see price
We dont have $102k today and we wont have it tomorrow. I still want our files back so I am trying to find a solution.
then you need to collect it
Well we need time to see what can happen. Everything is closed for the weekend so can you push this clock a few more days?
Is 2 days enough for you?
Can we get until Tuesday to sort this out?
to much time - we can expend timer only until monday
Can you at least extend it to the end of the day tomorrow? Everything
is closed since it's the weekend and we won't be able to get anything
done until tomorrow.
ok
Thanks, the timer expired it seems but I will get back to you later this afternoon
The amount you're asking from us given our size and revenue is just way
off base and we're struggling to see how this number was determined.
Obviously you got into our systems and got some of our files, but we
can't make this large of a payment. I can honestly pay you $8,775 and
even that is really stretching it
dont waste our time
How am I wasting your time? This is a real offer. Our revenue has been
down 70% since last year, we don't have the ability to pay over $100k
We are not interested in this.
We have indicated the amount for you.
Your proposal sounds stupid.
If you are not willing to pay more.
bye
We both know we're not able to pay $100k. What is a better price that
we can work toward? I can't shell out 6 figures, we will lose our
business
90k our last price
not lower
That's a really big gap between what we have vs. 90k. I'll need a few
days to get my finances in order and see if we can make something work
ok
news?
I'm not even close to $90k yet, but looking into something tomorrow. I will update you tomorrow okay?
ok
Could you please send a couple more example files of the data you have?
I'm working to get a bit more cash today and should have an answer for
you in a couple of hours
wait for answer
proof 3
Thanks
I don't know where you are in the world, but Alaska relies heavily on
tourism for revenue. With 2020/COVID, no travel to Alaska was permitted,
so we lost ~30% of sales revenue from this. No one was buying our
product, even through the summer months (which is usually high time for
tourists). Without these tourists, we really struggled to make ends
meet. I'm making slow progress to get extra cash, the most I have right
now is $12,825
not interested
make a really interested offer for my boss
We'll never have $90k, please help me out on this. What I'm offering is
a lot for a small business owner like myself, I don't have the kind of
cash flow like other years. Talk to your boss for me please
my boss can offer 20% discount
hello , are you ready for dialogue ?
Sorry we had issues reaching your site over the weekend but I'm here
20% discount off the $90,000? So this would be $72,000?
yes
I only have about $13,000 right now
then you need to collect money
I don't think I can ever get 70k, that's more than I make in a year
Any chance you can wait for next week and I should have a bit more ?
You ask for too much time
I don't have $70k
Can you wait for Friday then?
friday its last day for you
hello, are you ready to pay ?
Hi, I don't have the entire amount, it's really not something I can easily get. Today I have $15,300
Can we agree to that?
wait for answer
ok
You agree to this?
yes
Okay I can do it on Monday thanks
// Analysis
Analyst Observations
- REvil (also known as Sodinokibi) was responsible for high-profile attacks including Kaseya and JBS. The group was disrupted by law enforcement in late 2021 and early 2022.