{ "chat_id": "20201104", "messages": [ { "party": "Victim", "content": "Hello - what do we do to get our data back?", "timestamp": "17 days ago" }, { "party": "Victim", "content": "test files", "timestamp": "17 days ago" }, { "party": "REvil", "content": "Hello", "timestamp": "17 days ago" }, { "party": "REvil", "content": "You need to make a payment and you will get a universal decryptor for your entire network.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "File 1", "timestamp": "17 days ago" }, { "party": "REvil", "content": "To decrypt the second file, I need a note with the id \"readme-[redacted].txt\". Send it to me in this chat.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "After payment, the system will generate and give you a universal decryptor that will work on any device in your network.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "In this case, this incident will not be advertised in the media and, if\n necessary, in this chat you can always get technical support in case of\n problems.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "Correction, file with id \"readme-[redacted].txt\" is required.", "timestamp": "17 days ago" }, { "party": "Victim", "content": "this readme?", "timestamp": "17 days ago" }, { "party": "Victim", "content": "a few things. this is weekend and everything is closed until tuesday. \nwe cannot even begin to figure out the process but there is no one to \nspeak to, I see deadline of 3 days, please increase to 7-10 days to give\n us enough time to process this situation.", "timestamp": "17 days ago" }, { "party": "Victim", "content": "can you do discount on the amount you are asking? we are in the \nCaribbean and financial systems are partially disabled due to covid.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "File 2", "timestamp": "17 days ago" }, { "party": "REvil", "content": "I will set the timer for you until October 14, in my opinion this is \nenough to make a decision. As for the discount, I might be able to \nconvince the boss to give it to you, but you ask for many extra days.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "Everything is up to you, quick payment in a short period of time, implies a good relationship and conditions of redemption.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "Prolonging the process only aggravates the problem.", "timestamp": "17 days ago" }, { "party": "REvil", "content": "Time added, refresh the page.", "timestamp": "17 days ago" }, { "party": "Victim", "content": "can you accept btc? every broker we spoke to said it will take a long \ntime for this amount of XMR. That is why we need time to find the right \nbroker who can supply xmr.", "timestamp": "17 days ago" }, { "party": "Victim", "content": "its the weekend and banking holiday", "timestamp": "17 days ago" }, { "party": "REvil", "content": "I have included the possibility of payment in BTC, refresh the page.", "timestamp": "17 days ago" }, { "party": "Victim", "content": "can you decrypt test from another office?", "timestamp": "15 days ago" }, { "party": "Victim", "content": "also --- can you provide list of what data you take? or some sample? when I speak to management it will help explain.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Here is:", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Ok, we will provide you the list and any details after payment, no problem", "timestamp": "15 days ago" }, { "party": "Victim", "content": "+ I am the IT manager and I do not make decision about money, but I \nwould like to close this soon as possible, can you provide a list of \nfiles or something to prove my boss that its not only decrypt?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "What exactly do you want to see?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Stolen [redacted] data are published in the blog in case of payment refusal or you receive a link to the files after payment.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "You can show your boss the instructive stories of other companies that refused to pay the ransom.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/", "timestamp": "15 days ago" }, { "party": "Victim", "content": "+ yes I show him this. But my company is in carribean there is no \nprivacy law, so easier to prove to boss what listing of the files you \ntake to convince. The decryptor is of secondary value to us.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "I want to solve this fast too, because I did not see family for few \ndays now. So anything you can do to help me when talking to boss will be\n much help.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "What proof do you need? We got access to your network, encrypted the \ndata there and downloaded it, I see no point in this question, we always\n do this, these are our methods, did you see our blog? You have two \noptions to get the files: after payment or publicly on the blog.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "looking for some sort of a file list if you have of our files. because \notherwise the boss is waiting for IT to finish investigation and this \nwill take long time. I want to do this faster. Can you send a list of \nthe files?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "You forget that in addition to not being covered by the privacy law, \nyour company is exposed to the disclosure of your internal information \nto the whole world, plus you incur reputational losses. Which client \nwill want to become a premium card holder if the companie which do not \ncare about their data safety?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "You asked for more days to raise funds, you got this opportunity. If \nyou now want to communicate with us in an ultimatum form, then be \nprepared to get the same effect from us and complicate an already \ndifficult stage of negotiations.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Now print out the whole dialogue and bring it to your boss. We can go \nback to the previous timer, after which the amount will be doubled and \nthere will be no discounts. There is no one here who is going to play \ngames with you, or we make a deal and you get a decryptor + link to your\n files. Or just close the dialog and do not waste your time.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "I do not know if you have problem communicating in English or whether I\n am speaking to an operator with bad temper but your response is not \nsmart business. Do not threaten us again, because if you make more money\n publishing information, then good for you. Otherwise, you are taking a \npossible client who is willing to pay and basically start throwing a \ntantrum like a child. I would like to speak to an adult please who can \nunderstand business and knows why I am asking for what I am asking.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "Now, let me repeat. I am trying very hard to work with you and you need\n to understand that we understand perfectly what position you are in, \nand what position WE ARE IN. I also check your reputation and you guys \nalways deliver on your promise which is great and it is a strong basis \nfor a good business transaction.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "Here is what I need to move this forward, it is a very simple ask. We \nneed a sample of the data you take and a file list of the files you \ntake. It is not difficult and it is our files anyways, so what is the \ndifficulty? All this will do is prove that you are indeed in a position \nof power, and I will be able to convince my boss that we need to speak \nabout payment. I am TRYING TO HELP YOU AND ME. So work with me, or ask \nyour boss to put someone else to work with me. And I also ask that you \nstop threatening me, your team already do the damage, so now we can \nspeak and reach agreement or you can play games of threats and verbal \nabuse. Let's pretend we are adults ok?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "My reaction is the result of your work. I don't see before me people \nwho value their business, I see attempts to study the possibility of \nmitigation of the attack. We really keep our promises, there is no need \nto doubt it. We give the decryptor, we give references to the stolen \nfiles, we publish the files in case of a deal failure. And now we can \nimagine that we are adults and can discuss the deal.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Understand one thing and bring it to your boss, decryptor and \nconfidentiality is need not for us, but for you. Do not scare us without\n paying, there are dozens of you, it is better to concentrate on your \nproblem.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "If my boss intervenes in this dialog, then it will not be \ncommunication, but two words and a timer per day, you are still lucky to\n deal with me, because I have time to answer you.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "I am not going to enter into long correspondence and polemics anymore. \nYou know the terms and conditions and they will remain unchanged.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "1. We fix the amount of the transaction after the final value is approved.\n2. You pay the ransom in moneon or bitcoin.\n3. After payment you get a universal decryptor for all infected computers.\n4. You get a set of links that contain your files.\n5. After downloading your files are deleted from our servers without the possibility of recovery.\n6. No one but us will know about this incident.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "You can read about Travalex, a very instructive story. They had the \nopportunity to prevent it, as a result, this error became inexcusably \nexpensive for them.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "I read about you in media and bleeping computer. I have no doubt you \nwill follow through and while my boss will make the business decision, I\n am trying to follow his instructions and work with you. I am asking you\n to work with me and give me what my boss is asking for. Let me further \nexplain, our systems are almost back-up, but I am trying to reach common\n ground. Can you share the list of files you take? My boss does not care\n about publicity, but he does care about protecting people, if you can \ndemonstrate what data you take, even just file list, it will go a long \nway in the discussion here. I am not trying to waste your time or mine, \nthis will help no one. I know you are big group and you attack many \ncompanies and that we are just a number. I also understand you have the \npower. I am trying to be honest and explain to you what will help me \nhere, this is the process I need to follow. So the question is whether \nit is possible for you to give me list of files or no. If no, I will \ntell my boss and we can figure out next steps. But let\u2019s try to work \ntogether.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "At this stage of negotiations - my answer is no. The situation may \nchange if we find a compromise and reach an agreement. I do the same as \nyou and follow the instructions of my boss. Tonight he will get \nacquainted with the dialogue and if there are new instructions, you will\n learn about it.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "And I work with you, at your request was given +4 days, as well as \nenabled mode of bitcoins to accelerate the process of receiving funds. \nThis is done first of all for you so that you can recover your systems \nfaster and get back to work.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "At this stage of negotiations - we cannot proceed unless you provide us\n with the list of files and 2-3 random sample files you took. If you \nbreak negotiations at this point, you are going to publish the data \nanyways, so there is zero difference between giving us the information \nor publishing. The only key difference is that if you publish instead of\n giving us the information we need, there will be zero chance of further\n negotiations. I hope your boss reconsiders his position so that we can \nfinally move forward.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Ok, but in return I reduce the timer for decision making.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/[redacted]?s=[redacted]", "timestamp": "13 days ago" }, { "party": "REvil", "content": "This link is not yet visible to anyone except you.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "First, thank you for finally providing this information which will \nallow me to work with the boss. Second, I will certainly push to make a \ndecision as fast as possible. HOWEVER - reducing the timer will not \nwork. Actually because you delay the analysis for no real reason we will\n need more time. Given the amount it will not happen before Friday. You \ncan try and push and you are doing a great job of that, but in a company\n that needs to follow process, it will not work and all you will do is \nend up losing this opportunity to close the issue for both side. Please \nincrease the timer as we are asking. I am trying to work with you.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "We gave you enough time to make a decision. If your boss doesn't want \nto pay $6kk but wants to get off with a smaller amount, let him hurry.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "We can argue together and you can argue you gave us enough time. In a \ncompany that is publicly listed, 3 days is not enough time. So let's \nstop with the games here, we are trying to work with you and I have no \ninterest to play games, I tell you what I need not because I feel like \nit for fun and giggles. It is also not my money, so all threats mean \nnothing. I am speaking to you because of genuine interest to solve the \nproblem and make sure we conclude this successfully. If you run the \ntimer and publish the conversation is over. I know you do not care \neither but I am sure we are both interested in getting this to \nsuccessfully conclude. You took the first step in showing me what I \nneeded, now do whatever you need, but I am telling you that your new \ndeadline is not going to happen. Your call how we do this.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Companies that are traded on stock exchanges, solve the problem in 12 \nhours, I say this because I know. I see that your actions are only aimed\n at delaying the solution of this incident.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "4 days ago you have asked for additional time to buy XMR, at now you \nwrite like you only now start consider payment process. Who play games? \nYou already had plenty of time to make a decision and consider different\n options. Now your task is to go to the boss and come to me with the \nanswer. The timer will not be moved until I get information about the \ndeal.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "You decision, your rules. I will pass on your message certainly.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "and just so you know... Carribean rules because of USD embargo during \nCovid, Maybe do some research on this. Either way, you are not changing \nyour position, I understand. Please understand that when timer expires \nif you publish this conversation is over and second, there will not even\n be a negotiation on price until the boss does his analysis. Thank you \nand have a wonderful day.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Think not about the fact that we will not make a profit, think about \nthe problems that will arise after publication. Have a good day, too.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "Understood. It is a 2-way street my friend. We either try to work \ntogether or you already decide to publish etc. That is why I asked for \nthe data so that I can prove to the boss that it is a serious situation.\n But it took you time, now I need the time to work on the boss.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "I do not need to be persuaded, go to the boss and come back with an answer, you have little time left.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "You will have another day after the publication sees the world. For now there will be no link to downloads.", "timestamp": "13 days ago" } ] }