{ "chat_id": "20210401", "messages": [ { "party": "Victim", "content": "hello, i have read your site and i have informed my boss. \nHe asked if we can pay you 8000 euro to your bank account to be able to \ntake our files back but how can we be sure you will help us?", "timestamp": "16 days ago" }, { "party": "REvil", "content": "Hello.You offer is very small.Not interested.", "timestamp": "16 days ago" }, { "party": "Victim", "content": "we have lost about 41 days of data since our last backup in some of our\n systems. Some systems have been fully recovered so we can start working\n but it will take us more than 2 weeks to do manual work for adding \nthing to our system. My boss told me to figure out a way to make a deal \nwith you so we can pay you. that way you can help us recover the lost \ndays faster instead of manual work. Please help us recover our data \nfaster. I now work with my technician to see the faster way to start \nworking, so an option to work with you would be best if it is faster.", "timestamp": "16 days ago" }, { "party": "REvil", "content": "Your offer looks ridiculous.Make a really interesting offer to my boss.", "timestamp": "16 days ago" }, { "party": "Victim", "content": "why you say ridiculous sir? i am trying to find a way to make this work for both sides so it has some value to us. \nIt would be great if you have the solution and we can get our files \nfaster because my technician now wants to format computers and start \nfrom our latest offline backup to set things up clean.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Then ask your technician if they can help you with personal data leaks.\nAlso, in case of non-payment, your information will be published in our blog and disseminated in the media.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "can we find a way to recover our files faster than our technician can \nrecover them? Our technician said that we need 2-3 weeks of manual work \nfor formatting, setting up and manual input to get most of our systems \nback to work. This is a long time and it involves some costs from our \nside. How much time your service will take to recover our systems back \nto normal and what is the process? Our technician works hard in the last\n two days but his process is very slow and we will have to involve some \npeople for manual work. This is time consuming. I want to understand if \nyour service is faster first of all.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Everything happens automatically after payment.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "so you mean that within one day we will have all files restored and all systems running as they were before the problem?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Yes , all right.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "that is a good option because if we are able to move faster with your \nservice this will have important impact in our office. Now regarding \npayment, Do you believe that we can work together to find a viable \nsolution to the cost so we can select your service instead of manual \nwork that will take us a long time?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Make a really interesting offer to my boss. And we can work.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "the problem is that at this time the Covid situation in our country has\n severely impacted all the business. greece is under a heavy financial \ncrisis for over 10 years and our office is closed due to government \nlockdown. cashflows are probably the worse in years. due to crisis we \nall work remotely and this year probably will be the worst in decade. So\n cashflows are really limited. can we agree on 12000euro paid in your \nbank account so you can help us?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "First, we do not accept payments to a bank account.\nSecondly, our boss is unhappy with your proposal.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "can we please find a solution to this payment? I want to express that \nsince your solution is faster than our technician we want to work with \nthe faster solution but it should be an amount that we can pay fast and \nget our files. Our technician said that he needs only time to get us up \nand working along with manual work. But time is important here for my \nboss. Please discuss with your boss to settle to an amount that we can \npay. Please consider that we need also time to see how your payment will\n be done, so as the time passes your services will not add any value. We\n want to work with you to purchase your professional services to help us\n recover faster than our technician.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "My boss is ready to give you a 20% discount on fast payment.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "Thank you, in that case we are ready to pay 12000 - 20% = 9600euro. We \nwill have the money in 3 days. we appreciate it. let us know how you \nwant us to do the payment.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Friends, you apparently did not understand, we are ready to provide you with a 20% discount from the original price.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "170000-20%=136000 $", "timestamp": "15 days ago" }, { "party": "Victim", "content": "how we are supposed to find this money? our offices our closed and \nduring covid this money is not something that can be found. could we \nplease discuss a realistic amount?", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Make a really interesting offer to my boss. 12k euro its small offer.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "can you please adjust your offer to greece so we can pay you and get \nour files faster? the money you ask is unfortunately far more than my \nboss capabilities. 12.000 seems little for you? the average salary here \nin greece is 500euro per month. Please sir lets discuss an offer that \ncan be paid fast. if we need 10 months to find the money you request \nthere is no use for the files. right now we need to recover faster. \nplease talk to your boss. we can find the money i suggested in 3 days and send it to you if you agree", "timestamp": "15 days ago" }, { "party": "REvil", "content": "Your offer is too small to be considered.Make a really interesting offer to my boss.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "tomorrow my technician will have a clear view of the main systems that \nare up and running so we can estimate and focus on the things we are \nmissing from backups. He said that most systems are in place from our \ncloud provider, so i will be back to you if we need your help with your \nservices. i thought that we could have your help on this so we can use \nyour service to launch faster but our technician said we should wait for\n his results recovering from cloud and then see if anything missing so \nwe can focus on that.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "If you do not pay, your files will be published on the blog and \ntransferred to the media, the rest of the data will be sold. In any \ncase, it will affect your reputation, think about your clients, fines \nand other troubles that await you. \nWe you a solution to avoid all of this.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "Sir, we just need to save time restoring our files. If you have a \nsolution to this let me know if we can work together. i just want to \nsave time to launch faster. this is our focus her.e. but I believe this \nwill take also time because you cannot understand that time is important\n here. If we could have the files yesterday it would make a great deal \nfor the office. we are losing more than 1000euro every day we delay.", "timestamp": "15 days ago" }, { "party": "REvil", "content": "wait for answer.", "timestamp": "15 days ago" }, { "party": "Victim", "content": "ok", "timestamp": "14 days ago" }, { "party": "REvil", "content": "Everything my boss has to offer $ 136k.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "you are still referring to thousands of dollars sir?", "timestamp": "14 days ago" }, { "party": "REvil", "content": "Yes, all right.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "I told you that our office is in greece and if you read the news we are\n closed by lockdown and it was the worst year for any office here in \ngreece so such an amount unfortunately is not something that is \nfeasible.\nSo please consider if you can really help us work with you in some way.\nWe have about 2 days until weekend to decide because new equipment has \nbeen ordered to set everything from scratch. Hopefully the most \nimportant system from our operation is up and running today. We are \nmissing a lot of data still and in 1=2 days we will have a total \nestimation of losses that require manual work.\n\nThank you for communication.", "timestamp": "14 days ago" }, { "party": "REvil", "content": "This is my boss's last sentence.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "in 1-2 days we will have a meeting with our outsourced technician to \ncheck everything that is missing. all depends from the cost. estimation \nof lost data. still your cost is far too high to be able to pay. I still\n tell you that we are willing to keep our options open and your service \nof instant full recovery is still an option for us. But we need to work a\n lot on the price to be able to see it as an option.", "timestamp": "14 days ago" }, { "party": "REvil", "content": "Your price is still too low for this amount of work.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "unfortunately our estimation was wrong. we had a briefing from our \ntechnician right now. there is a lot more work to be done, not only 1-2 \nweeks to do manual work. probably we will need more than 30 days. our \ntechnician said that the attack was well planned and we estimate lots of\n effort to recover from manual work. also we will have to delay a lot \nbecause of the malware is still inside. So we will have to replace \nsoftware and probably hardware until it is fully cleaned. Let me know, \nif we work with your solution, the malware will be gone from our network\n ?", "timestamp": "14 days ago" }, { "party": "REvil", "content": "Yes of course.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "our technican asks how you did the attack, through remote desktop or mail?", "timestamp": "14 days ago" }, { "party": "REvil", "content": "After payment we will conduct an audit for you.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "ok that is an added value. an audit would cost about 5000-10000euro. So\n you will decrypt files, our systems will be up and running in 1 day, \nour systems will not contain malware and also you would conduct an \naudit. correct?", "timestamp": "14 days ago" }, { "party": "REvil", "content": "Audit means we will tell you how we infected your network.For your large network, this will cost a lot more.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "how much this would cost? Now i am helping my boss estimate the overall help of your service.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "greek companies for our audit gave us an offer between 5000-10000 euro.\n don't forget that in greece such services are much cheaper than US.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "according to my boss we are ready to pay much bigger amount to get at \nleast some of your services. But we would like to ask you a very serious\n discount to your valuable services in order to reach a deal. We \nunderstand that you are trying to extract as much money as you can from \nthis deal, but the amount you demand right now is not something we can \ndiscuss. We want to work with you and we can find more money. Try once \nmore to discuss with your boss. if we reach a deal of around 45.000euro \nwe will manage to find the amount in some days. and we can send it to \nyou in some installments.", "timestamp": "14 days ago" }, { "party": "REvil", "content": "1-We will check how we got into your system.\n2-Get the whole network decoder.\n3-All sensitive data will be deleted from our servers.\n4-Let's clean your network of our virus.\n5-You will restore your system in one day.\n6-Neither reputation nor customers will suffer.\nIt all depends only on your actions.\nWe have been the administrators of your network for a long time and we know that you can pay 500k.\nWe have made a huge discount and look forward to serious offers from you.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "ideally we would like from you the following:\n1. get the last data from one virtual machine to save lots of manual work\n2. stop your attacks to our network so we can do business because we lose more than 1000euro/day as we delay.\ncan we agree on 55.000 so we can end this before weekend? we will show some good will to send you some money as soon as we can.", "timestamp": "14 days ago" }, { "party": "REvil", "content": "wait for answer.", "timestamp": "14 days ago" }, { "party": "Victim", "content": "also we have serious problem with monero. please check if you can give \nus bitcoin wallet as our accountant said that we have problem with \nmonero.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Yes of course.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "lets work on the price. so if you accept on 55k we can find the money \nand we will use bitcoin to send you asap. now our accountant tries to \nwork with the cryptocurrency thing.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "if we send you bitcoin how much time it takes for you to receive it and send us the solution?", "timestamp": "13 days ago" }, { "party": "REvil", "content": "30 minute", "timestamp": "13 days ago" }, { "party": "REvil", "content": "but we cant accept 55k", "timestamp": "13 days ago" }, { "party": "Victim", "content": "please sir give us a price we can pay today because the price you \nrequested will take lots of time. give us your best shot so we can move \nthe process today", "timestamp": "13 days ago" }, { "party": "REvil", "content": "wait for answer.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "please try to match what we have so we can find the funds easily and \nmove faster because time is important for us so that we don't have to \nsetup all the network again from scratch. lets try to match the price of\n the current offer because we have these funds available now, so if its \nclose to that we might be able to find the funds today. our accountant \nsaid that it will take days to find a lot of extra money because it is a\n matter of cash flow, exchanges, banks and stuff that we don't \nunderstand.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Ok, we take you the last step to meet $ 100k.", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Price update refresh the page.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "the price of 100k$ is about 85k euro. it is a price that i think we can\n meet. i want to talk with our accountant to check how fast we can find \nthis amount and start the process to find bitcoin", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Okay we wait", "timestamp": "13 days ago" }, { "party": "Victim", "content": "Just to repeat our deal. Once you receive the requested amount:\n1. You will stop any bad actions to our network\n2. You will provide decryptor that will decrypt all computers in our network\n3. You will help us if we have technical problems\n4. You will stop any other bad actions regarding our office\n5. You will provide security audit for our office\n\nCorrect?", "timestamp": "13 days ago" }, { "party": "REvil", "content": "Yes , all right.", "timestamp": "13 days ago" }, { "party": "Victim", "content": "our accountant has some serious problems with transferring the money on time.\nCan you please extend the time so we can be able to pay the greed amount in bitcoin?", "timestamp": "13 days ago" }, { "party": "REvil", "content": "How much time do you need ?", "timestamp": "13 days ago" }, { "party": "Victim", "content": "it might be from today until Wednesday for the processing to be done \nsince we our accountant has never done it before. He thinks he can get \nall the amount we have agreed but he is missing some for now and \nprobably it can be found during the day. And then he needs to transfer \nthe funds so that the processing to bitcoin happens. So i think until \nWednesday/Thursday or maybe much earlier if all is done today.", "timestamp": "12 days ago" }, { "party": "REvil", "content": "Okay we give until Wednesday.", "timestamp": "12 days ago" }, { "party": "Victim", "content": "thank you. expect update from our side.", "timestamp": "12 days ago" }, { "party": "Victim", "content": "can you please update the timer?", "timestamp": "12 days ago" }, { "party": "REvil", "content": "Okay.", "timestamp": "12 days ago" }, { "party": "Victim", "content": "we will do test payment first to see if you receive it ok? will it show in your system automatically?", "timestamp": "12 days ago" }, { "party": "REvil", "content": "No problem.", "timestamp": "12 days ago" }, { "party": "REvil", "content": "Yes", "timestamp": "12 days ago" }, { "party": "REvil", "content": "Wait for 3 confirmations by Bitcoin system, it takes ~30 min", "timestamp": "12 days ago" }, { "party": "REvil", "content": "To use a decryptor run it as administrator and turn off antivirus before.\nYou can use a decryptor as gui application or through cmd.\n\nCMD commands:\nUniversalDecryptor.exe -full\nUniversalDecryptor.exe -path \"C:\\folder\"\nUniversalDecryptor.exe -file \"C:\\folder\\file.txt.random_ext\"\n\n* decryptor with -full option will decrypt all with default params.\n\nIf you use it as gui application, mI recommend you choose \"create \nbackups\" option. If you use decryptor without this option, you should \nnot interrupt decryption process, otherwise some files will be \nirreversibly damaged.", "timestamp": "12 days ago" }, { "party": "REvil", "content": "1. Backup (provided there is no direct access to copies from local machines)\n2. It is important to regularly evaluate which employees have access and\n permission to which resources. Most employees do not need a high level \nof domain access.\n3. Use professional e-mail and web security tools that can analyze the \ncontent of websites, email attachments, and files for malware.\n4. Keep your operating system, software and all devices updated on an ongoing basis.\n5. Antivirus software, IPS (intrusion prevention systems) and corporate \nemail protection have been updated to the latest version.\n6. Divide your network into specific security zones so that malware caught in one zone cannot spread to others.\n7. Security training courses to teach employees not to download files, \nopen email attachments, or follow unknown links in messages.", "timestamp": "12 days ago" }, { "party": "REvil", "content": "Your network was accessed through your VPN.", "timestamp": "12 days ago" }, { "party": "REvil", "content": "All your data was automatically deleted after receiving payment.\nOur presence on your network will soon be terminated.", "timestamp": "12 days ago" }, { "party": "Victim", "content": "how long have you been in our network?", "timestamp": "12 days ago" } ] }