Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Negotiation Chat – Nightspire

These negotiation chats are offered to you by Valéry Marchive and Julien Mousqueton.

Chat ID: 202504280528742

Victim Avatar
NSPIRE****
How can I help you?
Gang Avatar
Victim Avatar
Hi there. We are a small charity organization. We help poor communities with food and medicine. Can we please talk about this?
Hello. Yes, we are online. Ransom demand is $85k in Bitcoin. We have all your donor lists and sensitive files.
Gang Avatar
Victim Avatar
$85k? That's completely impossible for us. We are a non-profit with a very limited budget.
We understand it's a charity. But we took real risk to get in. Payment or we start leaking data soon.
Gang Avatar
Victim Avatar
Leaking would hurt our donors badly. It would also harm the vulnerable people we support every day. Please think about that.
Ok, let's negotiate. Our minimum right now is $60k if you pay quickly.
Gang Avatar
Victim Avatar
Even $60k is way too much. It would force us to cancel programs and lay off staff who help kids.
Then tell me. What amount can your organization actually afford?
Gang Avatar
Victim Avatar
After talking to our board, the absolute maximum we can raise is $10k dollars from emergency appeals.
$10k is quite low for us. But since you're a charity, let's do a test first to build trust.
Gang Avatar
Victim Avatar
Thank you. We can send 3 sample files for decryption proof. Is that okay?
Yes. Upload them here. Maximum 10MB each, different file types please.
Gang Avatar
Victim Avatar
Uploading now.
Victim Avatar
I can't upload on this app.
Using gofile.io
Gang Avatar
Victim Avatar
Thanks. https://gofile.io/d/****
Files received. Wait a mins.
Gang Avatar
Decryption done. Here are your three files back, fully recovered and perfect.
Gang Avatar
Victim Avatar
Thank you so much. We opened them and everything looks correct. No damage at all.
Good proof. Because you're non-profit and cooperative, our special price now is $55k.
Gang Avatar
Victim Avatar
$55k is still very difficult. We're begging major donors just to reach anywhere close to that.
Victim Avatar
Honestly, the most we can realistically gather is 45,000 dollars without shutting down our core work.
45,000? That's pushing it very low after all this effort on our side.
Gang Avatar
Victim Avatar
Please understand. Every dollar we pay comes from people who donate to save lives. We have no more.
Victim Avatar
If you accept 45k, we promise to pay quickly and keep everything quiet. No police, no publicity.
...Alright. For charity reasons and fast payment, we accept 45,000 USD as final. We want only BTC.
Gang Avatar
Victim Avatar
Really? Thank you from the bottom of our hearts. We'll start preparing the Bitcoin right away.
Here's the wallet address: bc1qxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Gang Avatar
Victim Avatar
Got it. We're converting emergency funds now. It should take about 4 to 6 hours.
Okay. We've paused the publication timer for you. Please don't delay too long.
Gang Avatar
Victim Avatar
Update: we're halfway through buying the BTC. Compliance checks are slowing us a bit.
Victim Avatar
Should be ready in another 2 hours or so. Thank you for your patience.
No problem. Just send the transaction hash here when it's sent.
Gang Avatar
Victim Avatar
Transaction is sent now! Here's the link: https://mempool.space/tx/xxxxxxxxxxxxxxxxxxxxxxx
Watching the blockchain. First confirmation coming in...
Gang Avatar
Funds fully received and safe on our end.
Gang Avatar
Sending you the recovery package right now.
Gang Avatar
Victim Avatar
https://gofile.io/d/***** You can find help.txt.
Victim Avatar
Downloaded everything safely. Testing on one isolated computer first.
Victim Avatar
Test successful! The sample files decrypted perfectly. No issues.
Excellent. You can now run it on the rest of your systems.
Gang Avatar
Victim Avatar
Starting the full decryption process on our main servers now.
Victim Avatar
10% complete already. Seems to be going smoothly.
Keep us posted if anything unusual happens.
Gang Avatar
Victim Avatar
100% complete! All files are back and readable. Huge relief.
Fantastic news. Congratulations on the recovery.
Gang Avatar
Victim Avatar
We can't thank you enough. Our programs can continue without interruption.
We're deleting all your exfiltrated data permanently now.
Gang Avatar
Deletion complete. No copies remain on our systems.
Gang Avatar
Victim Avatar
Is that really final? No chance of leaks later?
Yes, completely gone. We keep our word on this.
Gang Avatar
Victim Avatar
That's such a weight off our shoulders. Thank you again.
You're welcome. Business concluded.
Gang Avatar
Victim Avatar
Because of this, children will get food and medicine tomorrow.
Glad to hear it. Stay secure from now on.
Gang Avatar
Victim Avatar
We will. Take care. Goodbye.
Goodbye. Good luck with your mission.
Gang Avatar