// Ransomware Negotiation Transcript
REvil Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a REvil ransomware negotiation with a redacted victim organisation. The negotiation consisted of 52 messages exchanged.
The initial demand is not clearly stated in the transcript. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
Hello, are you a live person
Hello , yes
what can we do if we dont have this much money?
because we dont have $100,000
My boss can offer 10% discount for fast payment
we dont even have this money to pay in 3 days, we would have to get loans or other means of payment.
We can add time
how much time do you need ?
even if we get it, we have to buy monero and that takes time to clear
the funds, it takes weeks to get validated with any exchange.
binance.com - 1 day
why is this much?
why is it this much?
The price depends on your income
My income is only 10,000 a month. Its in the system it shows it that way
You work for a company, don't bluff with us
yea, i am the owner. the company is mine. Im not bluffing. I make 120k a
year and 10k a month I work for the company. this is [redacted] service
company. Our service call charge is $75 per service call. How can I pay a
100,000?
My boss can offer 10% discount
i understand and thank you but we need more of a discount
i simply cannot afford 90-100k
what guarantee do i have that my system will start working after i do what you ask for
check our name in web
I dont know this things. im just a [redacted]. Im asking a friend to look in to it.
I have to borrow money from friends. So give time so i can see what i can get
Okay
So I was able to get 35,000.00 so far from friends which i have now. I
understand this is your job and what your demanding so i can have mine
back. I respect that even when i don't.
But I checked your web and there are no guarantees.
I have family and i work for this money, so loosing it is not an option
for me. I need some type guarantee so i know your the guy and i wont be
lied to and loose the money
You can try trial decryption to make sure we unblock everything
You messed up my entire work and life. The only way I will pay you is
to be 100% sure you will release the files after I pay you.
The only way you can prove me is I will pay 10,000.00 for 1 specific database file. If you agree let me know.
And I don't know if that is also possible,
I don't have any guarantee from you.
We can agree to 35k and we guarantee that you will be able to decrypt all your files
Hello
We had 70% back up and i was able to hire IT guys to build me a new
system and restore 70% of my data. I spent 12,250.00 for this and I
don't have anymore the 35,000.00
I am willing to pay the balance to you to get the remaining data so I can continue with my life.
Let me know what you want to do. I will wait on you.
took long to get back to you as we were busy building a new system
These are just your problems.
Nobody made you pay other teams to get well.
Our decryptor completed this in a few hours.
20% discount is all that we are ready to offer
you made this problem for me.
Ok, I dont have the money. I am working on a job and will get paid in 2
weeks at most . so let me get the money together and will get back to
pay.
28,000.00 correct ?
I have 22,750.00 now. Let make the deal and move forward please. This is hard for me
price update you can pay
I dont understand what your saying ?
Nothing
I have to go to work. leave the answer when i get back tonight i will contact
R u asking what i can pay ?
are you ready to pay ?
Yes
I already transferred 22,750.00 to my friends account today to help me
send the money or xmr to you. I dont know this things how they work. We
have to purchase it and send it to you
also monero price is 273.97 today not 82.52
price fixed
when will i get the code after i pay
30 minutes
Hi, I just sent money to a friends account. He will transfer to his
bianca account to purchase monero and send it to you. I instructed him
not to send the full amount. He will send an amount and you have to
check and let me know that number so i can make sure its coming to you
and I will have him send the remaining balance.
should be done in few days
ok
we're almost done sending the first payment. Binance.us doenst support
monero, and neither does kucoin or coinbase. I had to buy litecoin on
coinbase, send it to cakewallet, and Im using that the convert to
monero. Maybe will take a few hours.
Just sent to the monero address above. Verify how much it is and let me know.
5 monero receive
// Analysis
Analyst Observations
- REvil (also known as Sodinokibi) was responsible for high-profile attacks including Kaseya and JBS. The group was disrupted by law enforcement in late 2021 and early 2022.