Akira — 20230707

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Akira Actor / other Date Not recorded

   > Congratulations, you have passed a surprise information security audit and become a victim of ransomware. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

2. Message 002 From Akira Actor / other Date Not recorded

   > list.7z // 493 KB

3. Message 003 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

4. Message 004 From Akira Actor / other Date Not recorded

   > We're looking through your files to calculate a fair demand to you. I will let you know the sum shortly. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

5. Message 005 From Akira Actor / other Date Not recorded

   > In case we don't have a response form you, we will have to post your data in our blog.

6. Message 006 From Victim Victim Date Not recorded

   > Hello, we're reviewing the list you sent us now.

7. Message 007 From Akira Actor / other Date Not recorded

   > Ok. We are waiting for the files request tomorrow.

8. Message 008 From Akira Actor / other Date Not recorded

   > Hello. Have you review the list?

9. Message 009 From Victim Victim Date Not recorded

   > Hello, we are still reviewing the list at this time but will have those files over to you as soon as we finish. Is this list everything? We want to make sure prior to sending over our requests.

10. Message 010 From Akira Actor / other Date Not recorded

    > Yes, this is everything.

11. Message 011 From Akira Actor / other Date Not recorded

    > We're willing to set a $350,000 price for ALL the services we offer.

12. Message 012 From Victim Victim Date Not recorded

    > You advised we could request some files from that list you sent. We would like to request the below: [redacted].xlsx [redacted]-2023.xlsx [redacted]23.docx

13. Message 013 From Akira Actor / other Date Not recorded

    > [redacted]2023.xlsx // 336 KB

14. Message 014 From Akira Actor / other Date Not recorded

    > [redacted].xlsx // 15.6 KB

15. Message 015 From Akira Actor / other Date Not recorded

    > [redacted]23.docx // 1.84 MB

16. Message 016 From Akira Actor / other Date Not recorded

    > Please review the files.

17. Message 017 From Victim Victim Date Not recorded

    > Okay thank you we are reviewing these. We still need some time to review the entire listing itself and we are a bit worried about your price. I dont think we can afford the 350,000 and theres no guarantee you wont just take the money and run off. How are we supposed to trust this process?

18. Message 018 From Akira Actor / other Date Not recorded

    > If we receive the payment within next 48 hours, we will provide you with a 20% discount. After payment you will receive a deletion log which means the raid drives that contained the only copy of your data are fully formatted and erased. There is no need to deceive you since we value our reputation and you will find no case where we didn't honor an agreement. If we fail to agree, we will not only publish your data but also notify all of your clients, partners, employees and so on. In some cases they will be guided on how to file a claim properly. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again.

19. Message 019 From Victim Victim Date Not recorded

    > We understand and thank you for the information. We're already in the process of trying to find out exactly how much we can offer you, but it won't be close to the price you gave us. We'll update as soon as we can. I know you said you can unlock our files can we send some over to you? We have a few file types we are concerned with.

20. Message 020 From Akira Actor / other Date Not recorded

    > To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. Our tool works on every system/file format. As for your upcoming proposal, we haven't talked about any discounts yet, so you're wrong since you have to get as close as possible to our initial demand to get this over. Thank you.

21. Message 021 From Victim Victim Date Not recorded

    > A lot of our files are larger than 10mb, how do we know the decryption will work on those larger files? Also you are mentioning a discount, is this something you can do for us? We will work on getting the files sent over to you but are concerned we cannot sent anything less than 10mb.

22. Message 022 From Akira Actor / other Date Not recorded

    > You can provide us with one of larger than 10MB. No one is going to deceive you.

23. Message 023 From Victim Victim Date Not recorded

    > Ok thank you, we are working on it. We will upload this once we have it, I just need to discuss with the others which ones we can send.

24. Message 024 From Akira Actor / other Date Not recorded

    > Please speed things up on your part. No one is interested in dragging this out.

25. Message 025 From Victim Victim Date Not recorded

    > [redacted].dwg // 10.4 MB

26. Message 026 From Victim Victim Date Not recorded

    > [redacted].pdf // 2.39 MB

27. Message 027 From Akira Actor / other Date Not recorded

    > Please wait for them decrypted.

28. Message 028 From Akira Actor / other Date Not recorded

    > Please send us the correct files. We do not see any signs of our tool.

29. Message 029 From Victim Victim Date Not recorded

    > These came from the machines you locked and you said this tool was going to work. This is a little concerning, but let me have our IT grab some more files to send you.

30. Message 030 From Akira Actor / other Date Not recorded

    > My tech dept has checked those files and they're not encrypted, so please send us correct files asap.

31. Message 031 From Victim Victim Date Not recorded

    > Please try what I'm attaching now to the chat

32. Message 032 From Victim Victim Date Not recorded

    > EncryptedSample[redacted].zip // 9.18 MB

33. Message 033 From Akira Actor / other Date Not recorded

    > We will try.

34. Message 034 From Victim Victim Date Not recorded

    > Just checking out what's going on? Waiting your response.

35. Message 035 From Akira Actor / other Date Not recorded

    > Please wait.

36. Message 036 From Victim Victim Date Not recorded

    > Hello? Are you still there? We are awaiting the files.

37. Message 037 From Akira Actor / other Date Not recorded

    > Hello. We're here. I've asked my tech dept about this.