Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Negotiation Chat — Akira

Return to Akira
Negotiation chats provided by Valéry Marchive and Julien Mousqueton.

Chat ID: 20260212

Initial Ransom
$400,000
Negotiated Ransom
$350,000
Ransom Paid
N/A
Victim
I found this note on my server. Can you help?
Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details. ATTENTION! Strictly prohibited: - Deleting files with .arika extension; - Replacing or renaming .arika and .akira files; - Using third party software to recover your systems. If you violate these rules, we cannot guarantee a successful recovery.
Gang
Victim
Yes, I've been authorized by my boss to communicate with you.
List.7z // 239 KB
Gang
These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal and guarantees not to publish or sell your data; 3) security report on vulnerabilities we found; 4) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Gang
Victim
Can you please provide us with the following files: [redacted].docx [redacted].pdf [redacted].pdf
http://temp.sh/[redacted]
Gang
Here are the files. Do you want to test our decryption tool?
Gang
Victim
Yes, we'd like to test your tool. Allow us time to gather some impacted files.
Victim
[redacted].pdf.akira // 1.19 MB
Victim
[redacted].doc.akira // 4.08 MB
Victim
[redacted].jpg.akira // 2.73 MB
Victim
[redacted].jpg.akira // 1.94 MB
Victim
[redacted].jpg.akira // 997 KB
Decrypted.7z // 10.5 MB
Gang
Here are the files. We will let you know the price soon.
Gang
Victim
Thank you. What’s next?
We're willing to set a $400,000 price for ALL the services we offer. We accept payments in BTC. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.
Gang
Victim
I’ll take this message to upper management, allow them time to discuss.
We are waiting for your decision regarding payment within 24 hours.
Gang
Victim
Management is still talking it over. This is a lot of money and we don’t have that amount of resourcing. They are asking if you are willing to work with us?
We are working with you. You do have what we are asking for. Your net income last year was above $2,000,000. Let's end this without complications.
Gang
Victim
That is without employee salaries, operating expenses, etc. so that number isn’t a true representation of our actual profit. A slight discount would go a long way for us, everyday that we are down due to the impact on our systems is losing us money.
$350,000 and we have a deal. Here is our BTC wallet ID for payment: [redacted]
Gang
You have 24 hours to give us your decision regarding this deal. If you stay silent, we will announce the breach on our blog.
Gang
The data of your company and your employees is now freely available. https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion We can delete them, but you have to agree to our terms and conditions.
Gang