Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

List.7z // 44.4 KB

These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

Please wait.

Files.rar // 2.68 MB

Here are the files. Do you want to test our decryption tool?

We're willing to set a $150,000 price for ALL the services we offer. We accept payments in BTC. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.

Please wait.

Decrypted.7z // 85.7 KB

Here are the files. The file vmware.log has been corrupted because of the interruption of encryption process. You can upload another file for a test today if you want.

Yes, this is the complete list. Your offer is unacceptable. Please reconsider asap, if you want to come to an agreement with us.

We do not work with 5 figure numbers. $135,000 and we will close the case today.

Guys, 6 figures doesn't mean $100,000. Our demand is higher. The leadership is willing to make an exception and is ready to accept $120,000 if you pay today. Here is our BTC wallet [redacted]. Let us know when you are ready to make a test transfer.

That means that your data will be posted on our blog. We've offered the best terms so let's end this already.

Tomorrow morning is the latest. The price of $120,000 has been approved for today only. Keep us posted on your progress.

Waiting.

Yes, we are.

We confirm the receipt. You can proceed.

Sure. We are waiting.

unlocker.7z // 1.77 MB

unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line ESXi commands 1) chmod +x unlocker 2) ./unlocker -p="/vmfs/volumes"

Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

Please wait.

Can you upload some problem files?

You only have 2 files that are still encrypted, correct?

Not a problem.

Thanks for the information. We will pass it to the tech dept for a revision. Please wait.

Vms were stopped before encryption.

We will let you know.

We will provide an update as soon as we get it from our tech team.

We are working on the solution for you. Please note that turning off the power was not the best decision.

Hello. Provide us with .arika files from the directory R:\[redacted]\.