Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Negotiation Chat – Nightspire

These negotiation chats are offered to you by Valéry Marchive and Julien Mousqueton.

Chat ID: 20260127091528

Victim Avatar
Hello. This is IT manager. We received your ransom note. Systems are down, files encrypted. We need the decrypt key to recover. Can we discuss?
Send UUID first.
Gang Avatar
Victim Avatar
NSPIRE*** Is it right?
Hi. Welcome. Ransom for full decryptor + master key + data deletion guarantee: 2 BTC.
Gang Avatar
We exfiltrated 1.8 TB: CAD models, proprietary algorithms, client project specs, contracts. Pay within 5 days or publish starts.
Gang Avatar
Victim Avatar
2 BTC. You mean, $22,590? That's enormous. We're a small-size engineering company. This would devastate us.
We know your size from internal docs. You have not small. 2 BTC is fair for the risk we took.
Gang Avatar
Victim Avatar
Still way too high. What's your realistic bottom line? We need to consult internally.
No bottom line yet. But if you delay, price increases. Tomorrow it becomes 2.1 BTC (+5%). Better act fast.
Gang Avatar
Victim Avatar
Understood. We'll get back soon.
Any update?
Gang Avatar
Still quiet? Timer ticking. 72 hours left before first leak batch.
Gang Avatar
Ignoring us again? Fine. We warned. Price now 2.5 BTC as promised.
Gang Avatar
More silence = more price + data release.
Gang Avatar
You think silence helps? Wrong. We post proof now to motivate.
Gang Avatar
Check our leak site: http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database/***
Gang Avatar
Already uploaded: 40+ files – sample CAD drawings, client bid proposals, source code snippets, financial spreadsheets.
Gang Avatar
Next batch in 24 hours: full IP folder + customer database. Pay or lose everything.
Gang Avatar
Victim Avatar
We saw the leak. Clients are furious – one already threatened to pull contract. This is catastrophic for our reputation and IP.
Victim Avatar
Please pause further publishing. We're ready to negotiate seriously now.
Finally awake. Leak paused temporarily. But damage done – your delay cost you.
Gang Avatar
New demand: 1.9 BTC. Pay quick or resume full dump.
Gang Avatar
Victim Avatar
The leaked samples are already hurting bids. We lost credibility.
Victim Avatar
We can do proof first? Decrypt 4 files to confirm tool works.
Ok. Send 4 samples. Max 10MB each. Using gofile.io and share the link.
Gang Avatar
Victim Avatar
This is the link. https://gofile.io/d/***
Received. Wait a mins.
Gang Avatar
Here – 4 files decrypted perfectly. Check them. Universal tool, no issues. https://gofile.io/d/***
Gang Avatar
Victim Avatar
Thank you. Files open fine, no corruption. We trust it works now.
Good. Now 1.9 BTC to wallet: bc1q...
Gang Avatar
48 hours max. Leak resumes if no movement.
Gang Avatar
Victim Avatar
1.9 BTC still crippling. Board emergency meeting – insurance covers partial, but max we can gather is 1 BTC from all sources.
1 BTC??? After your silence leaked our proof? No way. That amount is already lowered. Competitors would pay more for your designs.
Gang Avatar
Victim Avatar
The ongoing leak risk is worse than price. Clients calling non-stop. We push to 1 BTC. Fast payment if you accept – within 24 hours.
1BTC low after your games. But... 1.7 BTC final offer. Take or full client list + code repos next.
Gang Avatar
Victim Avatar
That amount pushes us to the edge, but better than total collapse.
Victim Avatar
We counter 1.5 BTC. Absolute max – pay immediately, NDA, no further leaks.
Ok. 1.5 BTC accepted. Your delay cost you higher than if you'd responded early.
Gang Avatar
Wallet same. Send tx hash. 36 hours.
Gang Avatar
Victim Avatar
Agreed. Thank you. Starting BTC transfer. Compliance takes 10-12 hours.
Timer paused. Update frequently.
Gang Avatar
Victim Avatar
We sent all amount to your wallet. Check this.
Victim Avatar
Hash: https://mempool.space/tx/xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Confirmed. Sending recovery files now:
Gang Avatar
https://gofile.io/d/***
Gang Avatar
Victim Avatar
You can fild help.txt.
Victim Avatar
Testing on test machine first.
Victim Avatar
Test success – sample model decrypts perfectly.
Proceed to production.
Gang Avatar
Any stuck files?
Gang Avatar
Victim Avatar
Fixed with retry.
Victim Avatar
100%! All data back. Systems operational.
Confirmed recovery?
Gang Avatar
Victim Avatar
Yes. Everything intact. Thank you.
Deleting exfil data now.
Gang Avatar
Purge complete – logs wiped.
Gang Avatar
https://gofile.io/d/*** deletion_log.txt
Gang Avatar
Victim Avatar
Final? No future leaks?
Yes. Word kept. No resale, no re-attack.
Gang Avatar
Victim Avatar
This saved our company. Huge lesson.
Patch vulnerabilities. Goodbye.
Gang Avatar
Victim Avatar
Understood. Thanks.