Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Negotiation Chat – Akira

These negotiation chats are offered to you by Valéry Marchive and Julien Mousqueton.

Chat ID: 20250117

> Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.
Gang Avatar
Victim Avatar
> yes
Victim Avatar
> how do i fix my computer?
> Hello please wait
Gang Avatar
Victim Avatar
> hello?
Victim Avatar
> is anyone there?
Victim Avatar
> I guess I'll just shut down and reformat since you are not answering
> Wait a second.
Gang Avatar
> List.7z // 1010 KB
Gang Avatar
> These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Gang Avatar
Victim Avatar
> hello
Victim Avatar
> hi
Victim Avatar
> I need help my files are locked!
Victim Avatar
> please help me I need my files
Victim Avatar
> I needz my filez bro
Victim Avatar
> yo i need my files back
Victim Avatar
> 10/07/2020 11:10 AM 75,909 [redacted].pdf 10/07/2020 11:10 AM 20,991 [redacted].pdf
Victim Avatar
> how much money do you need
Victim Avatar
> whats your demand
Victim Avatar
> i am willing to pay
Victim Avatar
> YEAH BOIII
Victim Avatar
> I gots work due for muh classes bro, hurry up
Victim Avatar
> DO YOU ACEPT WACKY BUCKS?
Victim Avatar
> Cashapp right now bro
Victim Avatar
> my grandma moves faster than you and she's dead
Victim Avatar
> what country are you in?
Victim Avatar
> What is your Political Affiliation?
> Wait a bit.
Gang Avatar
Victim Avatar
> YOUR COUNTRY SUCKS!!!!!!
Victim Avatar
> best i can do is 2 v-bucks
Victim Avatar
> I got some Chuck E Cheese tokens if that tickles your fancy
Victim Avatar
> I cant wait any longer i am watching paint dry
Victim Avatar
> okay fine...3 v-bucks take it or leave it
Victim Avatar
> you want some robucks? pls
Victim Avatar
> I got a $19 Fornite Card, Who wants it?
Victim Avatar
> chat are we cooked?
Victim Avatar
> [redacted].exe // 1.04 MB
Victim Avatar
> my local target wont let me buy any more gift cards, how should i pay you?
Victim Avatar
> money.jpg // 33.8 KB
Victim Avatar
> go ahead open it
Victim Avatar
> hello from the other side
Victim Avatar
> WEE WOOO WEE WOO
Victim Avatar
> You're probably wondering how this is happening XD
Victim Avatar
> i'm connected to your office cameras
Victim Avatar
> i have noth korean paypal how can i pay u
Victim Avatar
> R.gif // 1.71 MB
Victim Avatar
> Ill give you to the count of five to respond
Victim Avatar
> are we doing a deal or what?
Victim Avatar
> I guess i will reflash my computer. You guys are a joke lol. I need to do it the hard way smh
Victim Avatar
> shut-up-take-my-money.gif // 1.05 MB
Victim Avatar
> do you accept tiktok coins ?
Victim Avatar
> whats your OF?
Victim Avatar
> HONSE.jpg // 24.3 KB
> is your leadership aware of the incident?
Gang Avatar
Victim Avatar
> Duh?
> We're willing to set a $550,000 price for ALL the services we offer. Let us know asap.
Gang Avatar
Victim Avatar
> Hello
Victim Avatar
> Someone uploaded this locker to an online database of malware
Victim Avatar
> You need to give the corp a new password
Victim Avatar
> Are you official negotiator of Akira or just affiliate?
> Provide the link to that database and we will provide a new chat.
Gang Avatar
Victim Avatar
> Anyways, If you have direct access to Akira leadership, add me on Tox. I may have some accesses in the future that I want to send to you, depending on the group affiliate rates. ID: [redacted]
Victim Avatar
> https://bazaar.abuse.ch/sample/[redacted]/
Victim Avatar
> This is the link to the database - but i'm not the corp. I am an affiliate of another group.
Victim Avatar
> If you are the official negotiator or owner of Akira, could you add my tox specified above? I would like to have contact with you in case I have an access that i want to give.
> Thank you for this information. We will contact you if necessary.
Gang Avatar
Victim Avatar
> Hello
> Hello
Gang Avatar
Victim Avatar
> I have a USA access that im exfiltrating data from now, it is $400m yearly revenue as shown on zoominfo, although other sources like wikipedia say it has a yearly revenue of $900m USD. I was wondering if you are interested in me using your service to lock the corp. Let me know if you are open to discussion.
> We are not interested. Thank you.
Gang Avatar