Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Negotiation Chat — Akira

Return to Akira
Negotiation chats provided by Valéry Marchive and Julien Mousqueton.

Chat ID: 20260125

Initial Ransom
$550,000
Negotiated Ransom
$250,000
Ransom Paid
N/A
Victim
Help!!!
Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details. ATTENTION! Strictly prohibited: - Deleting files with .arika extension; - Replacing or renaming .arika and .akira files; - Using third party software to recover your systems. Negotiations with Akira can only be conducted in THIS chat room. You should ignore any attempts (such as emails/social media messages, phone calls, etc.) to redirect you to another chat or email address (proton.me is often used by unauthorized individuals) on our behalf. Be careful while working with recovery agencies as they often try to use your cyber incident to stuff their pockets. There are many risks for you to lose money and get nothing in return. If you violate any of these rules, we cannot guarantee a successful recovery.
Gang
Victim
Yes, Please!
LIST.rar // 96.6 KB
Gang
These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal and guarantees not to publish or sell your data; 3) security report on vulnerabilities we found; 4) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Gang
Victim
All options please
We're willing to set a $550,000 price for ALL the services we offer. We accept payments in BTC. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.
Gang
Victim
Thank you for your offer. This seems unrealistic amount for us. Can you cut it further so that we can shake hands?
it is realistic for you. Your net income last year was over $3M. What services would you like to exclude?
Gang
Are you going to work with us?
Gang
Victim
Don't go with the Revenue. We hope you are not aware about the Asset Bloating for securing future funds. Let us know a reasonable demand!
What are you offering?
Gang
Victim
We can offer $100K.
We are talking about your net income, not revenue. You have to be serious. Stop playing please. $100,000 will not be considered. $450,000 and shake hands. You have the money so let's end this peacefully.
Gang
Victim
That's what you can't see. It's internal. Our net income is not what you can google about. We can shake hands if we can set it for $150,000
The best we can do is $400,000. You can take it or leave it.
Gang
Victim
The best we can offer is $150K! Hope that's fine.
We're out of the deal then. Think twice.
Gang
Victim
Let us know a reasonable rate
If you at least doubled your amount, we would find a solution.
Gang
Victim
The final offer is $200K.
Add another $100,000 and we will shake hands. We prefer $300,000 or nothing.
Gang
Victim
Sorry! That's not possible! We can finalize it for $220K
$250,000 and we have a deal. This amount is only valid for this week.
Gang
Victim
Alright, our management agreed for it.
Victim
Before the transaction, we would like to know how did you gain access to the systems?
We do not provide services before payment. Here is our BTC wallet [redacted]. Let us know when test payment made.
Gang
Victim
Alright. But our manager told as the money is high, we need to know the vulnerability. So please answer how did you compromised our system ? Once you answer this, will initiate the transfer.
We do not provide services before payment. You will receive a security report that includes information about how we were able to penetrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure.
Gang
Victim
If you are going to get the general guidelines such as : Enable 2FA, VPN Use, Password Change etc, we are not interested to recieve it as Technical report. Before transferring this huge amount, we need to know how did you gain access to the system? Was it via Phishing, Compromised Password or any other method?
You have 24 hours to make payment. We will delete the chat and publish your data if there is no payment. That's our first and final warning.
Gang
Victim
We will not proceed with the payment unless we hear from you about the root cause of this infiltration.
Well, it seems you're not going to pay at all. We told you several times that you will get that info after payment. I think you can log out now.
Gang
Victim
If you are interested to receive the pay, then you have to comply to our request.
We don't have to do anything. If you need our services, you pay. That's simple.
Gang
Victim
If you want money, you just reveal the infiltration method. Simple!
We will but you have to pay for it. It is not for free.
Gang
Victim
We are not asking for the whole report. Only 1 single question which is simple to answer.
You have 24 hours to make payment.
Gang
Victim
Even if we pay, you will not reveal from where did you make the purchase of credentials, as instructed by our IT Team. So it's pointless! If you can reveal that, then we have the deal ready!
No one will reveal anything until payment has been received. Please do not waste our time and simply wait until we have prepared your data for publication.
Gang
Victim
No, we have been instructed that you won't tell from where did you make the purchase of credentials. So it's pointless. If you can reveal that, we can think about the deal!
This information will be provided only after payment. Are you going to pay?
Gang
You can find your company name in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion If you want this post to be removed, we have to agree on something.
Gang
Victim
First, confirm that will you reveal the source from where did you buy the credentials? Then we can think about the payment!
We confirm. Ready to pay?
Gang
Victim
Yes, then let us know from where did you made the purchase of credentials?
This information will be provided after payment. You ready with payment?
Gang
Victim
Nothing comes for free. Let us know the credential marketplace from where you made the purchase. Then we will transfer the amount.
We will provide the information only after payment. If you are not going to pay, you can log out.
Gang
Victim
We will only release the fund once we receive your input as we are unsure whether you will assist us post payment. So we should have something prior the deal!
Got you.
Gang