{
    "chat_id": "20201014",
    "messages": [
        {
            "party": "Victim",
            "content": "Hello guys,\nI am the person in charge to negotiate with you on behalf of my client. \nThe amount of XMR requested to my client to get the decryption tool, the\n files back available and not published in the dark web (I have seen \nsome exfiltrated data are published on your blog) is huge and my client \ncannot afford to fully pay your claims. My client is trying to cope with\n this difficult situation, since it has been heavily struck by the \ncurrent economic crisis due to the coronavirus pandemic, with a dramatic\n fall of sales in the last months. My client\u2019s net revenues amount to \nEUR 500.000,00 in the last financial statement (2.5 billion as gross \nrevenues, which is a not relevant data if you guys are acquainted with \neconomics). The financial situation of my client has been catastrophic \nsince 2010, with a substantial decrease y/y in net revenues and gross \noperating profits. The cyberattack you have carried out on my client\u2019s \nsystems has blocked the company operation and all its internal \noperations have been shut down including deliveries, and as a \nconsequence my client is not able to fulfil the market with its copper \nproducts and get revenues. My client has already had to make budget cuts\n and fire many of its employees or put them on unemployed insurance, \nwith devastating effects on families and children amid the economic \ncrisis due to Covid19. Therefore, it is impossible for my client to pay \nyou 7.5 million USD. According to my client\u2019s financial condition, I \nthink he might be considering paying a certain amount in order to \nprotect his business and to obtain the decrypting tool for all the files\n very quickly. However, such amount would be lower than the one you have\n requested, due to the heavy financial situation. In my personal \nopinion, my client has the financial availability to pay you 500.000 USD\n very quickly. A greater amount would be very difficult (almost \nimpossible in my very personal opinion) to be paid because of the \ncurrent financial situation. Let me know on this point.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Hello. We have deals with many companies every day, our pricing policy \ntakes into account the Covid19 crisis. Do not take cover by this, the \nprice is affordable for the company. 500k from a company like your is \nnot seriously, of course we can give you a discount that will depend on \nthe quickness of your payment, but price can't be too low as you ask \nfor. We hid the post from our blog for the talks. if we will have a deal\n this information will not be ever published.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "What kind of discount are you guys thinking about? My client is really \nin a dire economic situation as previously said and I will try my best \nto convince him to add few money on the negotiation table. However \nadding money to his last offer would entail more budget cuts and firing \nmore employees, leaving families without livelihood in this dramatic \nfinancial crisis.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "You have no chances with $500,000 or this level of amounts of money, even don't try bluf by this.\nIf you pay shortly, we accept $6,75M.\nIf no, we start publication data part by part to speed up you.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "we are not bluffing and you do not know the financial situation of my \nclient. However I will get back to you as soon as my client gives me a \nfeedback on your so called \"discount\"",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "https://www.sendspace.com/file/[redacted]",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "[redacted]_Consolidated Financial Report 310320.pdf",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "if you cant find your insurance manual. Here is it.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Oh well, so you guys are familiar with economics. Are you sure you are \nable to read the numbers? My Client has been losing money since 2010. In\n the consolidated financial report you exfiltrated you can see that in \nthe first three months of 2020 only the financial loss amounts to EUR \n[redacted] M. And take a look at the net financial position as at 31 March \n2020 which is negative by EUR [redacted] M. Moreover, look at bond trading \nlevel (30% yield) that my client needs to repay: \n[redacted]. The\n financial situation of my client is negative. I think you picked the \nwrong victim and the financial analysis you have performed prior to \nundertaking the hacking operations is absolutely wrong. Look at the \nchart herein attached and maybe you will be able to understand that \neconomics is not hacking and my client is not Grubman nor Travelex nor \n[redacted] (the latter, just to remain in the [redacted] boundaries and a victim \nyou may know).\nWith regard to the insurance manual you guys have exfiltrated please \nnote that the insurance company Chubb does not cover the expenses \nrelated to a ransom payment but only the expenses my client is is facing\n for business interruption and recovery.\nThis being said, my client needs to resume normal operations as soon as \npossible minimising financial losses due to inactivity caused by your \nactions. So we need to find a trade-off between your requests and my \nclient\u2019s capability to pay. Too much money requested and really my \nclient does not have that financial capability. My client understands \nyour position and aspirations but can\u2019t reach that amount. Overnight I \nconvinced my client to add more money on the table. His offer now \namounts to 750.000,00 but this will entail more sacrifices in terms of \nemployment and debt repayment. People will be fired amid this financial \ncrisis but I guess you guys don\u2019t care about people left without \nlivelihood.\nIf you guys don\u2019t accept it, my client will set up the new \ninfrastructure without data. It won\u2019t be easy but my client is pretty \nsure to go back on the business within a few weeks. I mean my client is \nmaking the argument that the cost to restart the new infrastructure \nwithout data will not be higher than 700-800 k USD. That amount \nrepresents the break-event point for my client. If my client pays a \ndollar more, it won\u2019t be convenient for him. So accept these 750 k USD \nor set a new affordable price or get nothing. If you accept or if you \nset a price which my client is able to meet, he will start the payment \nprocess as soon as possible, after finding a trusted exchange. \nPlease stop the countdown as usual during the negotiations with your hacking group.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Good morning. Sorry, but your offer still isnt interesting for us. \nCompanies with revenue like 10kk usually pays us this value. Comeback \nlater when you will be able to pay more. We can wait but your client \ndoesnt have enough time.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "If you think its easy to restore for 800k - go and do it. we dont care.\n first dump will be full of your client net passwords, [redacted] email \ndump, phone and password(that he use in many other services than your \nnetwork). next will be with clients info, NDAs, payment infromation and \ntechnical specification of your production",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Do you mean if we do not strike a deal in 1 day 8 hours and 41 minutes you will double the price requested?",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "sure not",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "i added you 7 days.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Ok guys. What I am trying to let you understand is that my client is \nnot in a good financial position and the financial statement you have \nhad to chance to read clearly testifies what I am saying. The production\n plants are on hold and people are put on unemployed insurances and are \nbeing fired. I know that you guys don\u2019t care because your goal is your \npersonal profit. You carried out a perfect and clean job on my client\u2019s \nnetwork I have been told and you clearly deserve to be rewarded for your\n work. The issue is not if my client is willing to pay but how much \nmoney my client can afford to pay without worsening his financial \ncondition and safeguarding jobs and families. This is the main issue. \nYou guys are considering the data exfiltrated as valuable data that may \ncause a catastrophic reputational damage to my client if disclosed to \nthe general public. Well, this is not the case. My client is not \ninterested if you guys disclose [redacted] email dump or NDAs or whatever\n document you have in your hands. The value of the data you guys have \nstolen is irrelevant to my client. My client resells commodities ([redacted]) with a B2B model, there\u2019s no industrial secret to be \nprotected. And again, please believe me that I\u2019m not bluffing on this \npoint. You have read the documents you have stolen and you guys are \nexperienced in the field: I bet you haven\u2019t found any information worth \nUSD 6.75 M. Any. So again, my client is interested in a quick restore of\n its network. Analysts have estimated that to restore the systems from \nscratch it will cost around EUR 800 k. Than there is the business \ninterruption which is also covered by the insurance policy you have had \nthe chance to read. If my client gets the decrypter, the network will be\n restored faster and the business will restart in a matter of days. \nOtherwise it will take longer but the costs incurred by my client will \nbe integrally covered by the cybersecurity insurance policy.\nThis being said, we are at a negotiation table. Your demands (USD 6.75 \nM) do not match our last offer (USD 750k ). We are way too far to reach \nan agreement. You guys say that our last offer do not you\u2019re your \nexpectations and to come back with a higher offer. But you guys have not\n lowered your request and showed any availability to reach an agreement \nand a win-win solution for both the parties involved. I mean, this is \nnot a negotiation. Are you guys willing to get a reward for your team? \nWhat if I convince my client to put USD 1 M on the table? My client will\n never pay you the amount you have requested, but with some sacrifice he\n might be able to reach the USD 1 M threshold.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "You write a lot of text but all of this doesnt matter. Why ? [redacted] is ONE\n of the WORLD's LARGEST manufacturers of [redacted]. Your \nclient spent some millions on recovery software and hardware for it, but\n admins using passwords like \"[weak password redacted]\". But sure we cant take your 1M \noffer because this is ridiculous. We are thinking that you are bluffing \nand trying to make price so lower, but I understand it is just your job.\n You working fine, price updated to $5M",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "hey, guys, thank for lowering the price.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "I mean that being one of the largest corporations does not imply to be the richest. This is the point",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "If my client had the financial resources you think the IT department would be stronger and [redacted] systems would be more secure",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "[redacted] IT department has proved to be very very little in terms of \ncapacity and you guys have been good to leverage the vulnerabilities in \n[redacted] network. But this is not the point",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "You are sure that [redacted] has the financial capability to meet your \ndemands. If you look at the reports as well as at the newspaper news you\n can easily see that [redacted] is in deep trouble.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "So I am not bluffing because I have been asked to keep the price as \nlower as possible. I am an experienced negotiator, I undertook many \nnegotiations with REvil and I know how to talk with you guys. I know the\n threshold I can or I cannot exceed. This is not the case. My client has\n a very limited financial ability and I am not fooling you around",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "So please do reconsider your demands and go for a win-win solution as REvil usually pursue.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "If you have undertook many negotiations with REvil you have to know that much smaller companies pay more than your offer.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Well, it hasn't been my case fortunately! Yes, I confirm I have \nundertaken many negotiations with REvil affiliates and I have not bumped\n into a negotiation with a payment of more than 1 M. Two months ago a \nREvil affilate attacked a very famous italian company. The intial \nrequest was 7.5 M USD, with revenues like [redacted]. The deal was closed at \nUSD 750 K. You can ask REvil affiliates if I am not speaking the truth.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Moreover [redacted] does not give a shit about the data you have stolen, so I \nhave been told. So please reconsider you request and maybe we can find \nan agreement.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "I think there were reasons for that, it is not for nothing that they \nreduce the price to 750k from 7.5m, you are too mistaken in thinking \nthat the situation is the same here. I could cite cases when companies \nwith ten times less revenue paid 3M, or paids 100k only for one personal\n computer, but it is not create rule, it is just an exception, \nexceptions only confirm the rule.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "I can see your point and I get it. I think I am not mistaken and the \nsituation is similar to the one I mentioned. I mean, the price paid \ndepends on many factors: 1) financial availability 2) ability to restore\n the network without the decrypter 3) time necessary 4) consistency of \nbackups 5) profit loss for buisness interruption and so on. What I am \nsaying that this is the sixth time I bumped into REvil and my client has\n never paid more than 1 M USD. But maybe they are exceptions that \nconfirm the rule.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Other Data Recovery Companies has never clients with paid more $5,000, \nbut it is not means we will agree for $5,000 in case like this.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "The situation is the following: 1) [redacted] has a very limited financial \navailability. 2) [redacted] is already working on network restoring (costs will\n be covered by the insurance policy) 3)the time necessary to restore the\n network from scratch will be almost 12 days 4) there are backups \navailable on LTO tapes 5) the profit loss for business interruption will\n be limited and covered by the insurance policy",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "I get your point but [redacted] offered USD 1 M clean, not 5 k$.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "In view of this situation, $ 5M is reasonable.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "[redacted] does not have $ 5 M. I can try to convince the client to add more \nmoney, but there no cash flow to pay the amount you have requested.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Of course. Because $1M too low.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "I know that the amount offered does not meet your expectations. What's a\n reasonable amount for you?Take into consideration what I have just told\n you in this talk",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Our offer $5M",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Waiting for your...",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Talk to the client and get back to you in a while",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "ok",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "good morning. do you have new information for us?",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Yes. Talked to the client and they shared that profit margins on \nrevenue that is generated is tiny, and due to the lack of business \nhaving actual cash to turn into monero is hard to come by. They \nunderstand you ask more money, but they wanted me to let you know that \nthey are having a hard time coming across more money. Now they have \naccess to USD 1.27 M in cash, but it won't be available until Monday \nsince they can't send money with the banks closed.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "We have good news to you, price $2.5M for this deal. We prefer Monero, \nbut provide you bitcoin payment method to make it easier for you. But \nthere is a nuance, if you pay in bitcoins, the additional commission is \n10%.\nAfter payment we will fulfill all agreements with decryption, will \nprovide any supports, delete the data from our servers and will provide \nyou short report on how you were hacked, keep in mind we still have \naccess to the network and watching for any movements.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Refresh the page to see changes",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "hello. are we waiting for your payment today?",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Hi guys. Sorry for being late but my client took his time over the \nweekend to have internal meetings in order to respond to your last \nrequest. Notwithstanding my client has strived to find more budget to \npay your claims, there is no more money available to be put on the \ntable. The financial condition of my client is terribile and you know it\n and the economic situation of Italy has been catastrophic since a \ndecade with impactson [redacted]. My client can't afford to take away anymore \nmoney from the budget needed to run the company operations and to pay \nemployees salaries. It has been a difficult decision and my client is \nfully aware that this decision could stop the negotiation with you guys \nand that consequently he won't get the decrypter. However my client has \nreached the maximum cap and the costs he might face without the \ndecrypter are, according to cybersecurity analysts and loss adjusters, \nclose to $ 1 M. So this is it. Let me know.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "If I understand correctly, your last offer is $1.27M, if we will agree, how many time do you need to make the payment?",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Yes, correct. We will need about a day since buying Monero takes time, especially when we use a broker in the USA",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Okay guys so medium price between your offer and our waiting is 1.5kk. \nprice updated for 48h and it is final call. Write a message when you \nwill start exchange for lock xmr rate.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Client again took some time to think about to your last offer. Due to \nthe fact that Monero has high transaction rates (around +10%), my client\n is willing to pay you 1.27 M within the next 48 hours. Client is not \nable to fully meet your demands as you know and understand. Let me know \nif this is ok for you and client starts the payment process.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "ok. price updated.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Please do confirm that the decrypter is general and works for each and every system you guys have encyrpted",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Yes. general decryptor works for all system that was affected",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "how much time do you need to make this payment?",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "hello?",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Be patient, we are working on it. Expect the payment very soon, a matter of hours.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Can you lock the Monero price for us? We are placing our order now.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Ok. Freezed",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Payment sent.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Waiting for 10 confirmations by Monero network",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "To use a decryptor run it as administrator and turn off antivirus before.\nYou can use a decryptor as gui application or through cmd.\n\nCMD commands:\ndec.exe -full\ndec.exe -path \"C:\\folder\"\ndec.exe -file \"C:\\folder\\file.txt.random_ext\"\n\n* decryptor with -full option will decrypt all with default params.\n\nIf you use it as gui application, I recommend you choose \"create \nbackups\" option. If you use decryptor without this option, you should \nnot interrupt decryption process, otherwise some files will be \nirreversibly damaged.\n\nHow it works with \"create backups\" option:\n1. Decryptor looking for encrypted file\n2. creating backup of file\n3. decrypting file\n4. removing the backup\n5. looking for a next file and loop repeating.\n\nYou can collect list of extensions, input to the textarea above the chat\n and click \"Download\" to generate General decryptor to decrypt files \nwith these extensions.\nBut this way is not necessary, because we provide you the universal \ndecryptor. It just works little slowest but you don't need collect \nanything, just download it and use on any system with admin rights, \nDOWNLOAD:",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Hi guys, thanks for reciprocating with decryptor. During our talks, you\n told me that in case of ransom payment you would have given my client a\n sort report on how my client was hacked. Can you please provide such \nshort report? My client is very interested about it and I think that \nafter the successful transaction he deserves to know the entry point and\n how you gained privileged access to the network. Thanks for \ncooperation!",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "hello?",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "Hi. We find a login to https://remote.[redacted].com",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "After that we made a kerberoasting attack and decrypt admin hash \"12qwer34\". That's all.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "you need to use any 2fa solution for your citrix server.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Thank you guys. One last question, did you guys buy the citrix server \ncredentials on the dark web? Or did you obtain the credentials in \nanother way? You know, it is important for my client to understand in \norder to prevent future attacks from other ransomware gangs.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "yes. we buy it. somebody of your clients employee was infected but not by us.",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "that's why i said to you that your client need to use 2fa on citrix server.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Thanks. Since you guys have been so available to answer my question, \ncan you please tell me which is the account whose credentials you have \npurchased? It is very important for my client to ascertain \nresponsibilities of the security incident",
            "timestamp": "1 month ago"
        },
        {
            "party": "REvil",
            "content": "sorry. i cant give you that information.",
            "timestamp": "1 month ago"
        },
        {
            "party": "Victim",
            "content": "Hello guys, sorry to bother you. But since the chat is still open I \nneed one more info from you. It's very important for my client to get \nthe full file tree and the list of the files you have exfiltrated, as \nwell as the logs of the delete operations of such files. Can you help \nme?",
            "timestamp": "7 days ago"
        },
        {
            "party": "REvil",
            "content": "Hello. We don't store even list of files of companies which paid, and as log file too",
            "timestamp": "7 days ago"
        }
    ]
}