Akira — 20230727

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Akira Actor / other Date Not recorded

   > Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

   Do you have a permission to conduct a negotiation on behalf of your organization?

2. Message 002 From Akira Actor / other Date Not recorded

   > list.txt.7z // 3.97 MB

3. Message 003 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

4. Message 004 From Akira Actor / other Date Not recorded

   > Please let us know whether you are interested in keeping the incident confidential. Your silence will be evaluated as a negative response.

5. Message 005 From Akira Actor / other Date Not recorded

   > You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

6. Message 006 From Victim Victim Date Not recorded

   > We found your note on our computers. What do we do next?

7. Message 007 From Akira Actor / other Date Not recorded

   > Hello. Can you see messages above?

8. Message 008 From Victim Victim Date Not recorded

   > Yes. We have downloaded the list and are reviewing it now. If we are going to come to an agreement, please remove our name from your website.

9. Message 009 From Akira Actor / other Date Not recorded

   > The post will be taken down after payment.

10. Message 010 From Victim Victim Date Not recorded

    > Please send back the following files: D:\[redacted].com\unpacked\T_Drive\Citrix\Applications\CommuniCap\[redacted]\WordDocs\[redacted]letter.doc D:\[redacted].com\unpacked\T_Drive\clients\[redacted]\Client\Archive\[redacted].xls D:\[redacted].com\unpacked\T_Drive\Images\[redacted]\Client\[redacted].pdf

11. Message 011 From Akira Actor / other Date Not recorded

    > [redacted].pdf // 1.66 MB

12. Message 012 From Akira Actor / other Date Not recorded

    > [redacted]letter.doc // 21.4 KB

13. Message 013 From Akira Actor / other Date Not recorded

    > [redacted].xls // 26.4 KB

14. Message 014 From Akira Actor / other Date Not recorded

    > Here are the files. Do you want to give us some files for a test decryption or we can move to payment details?

15. Message 015 From Akira Actor / other Date Not recorded

    > Hello. Let us know if you are interested in this deal. If you don't answer us today, we will have to move to your data uploading to our blog.

16. Message 016 From Victim Victim Date Not recorded

    > We are working on getting the sample files now. We want to resolve this with you and keep everything confidential, but we don’t know how this works. How much to resolve this?

17. Message 017 From Akira Actor / other Date Not recorded

    > I will let you know shortly.

18. Message 018 From Akira Actor / other Date Not recorded

    > So, we've gone through your files to define your financial abilities. We've been looking through your bank statements, net income, cyber liability limits, financial audits - all the info that might help us to calculate our demand to you. We're willing to set a $250,000 price for ALL the services we offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

19. Message 019 From Akira Actor / other Date Not recorded

    > So, where the files?

20. Message 020 From Akira Actor / other Date Not recorded

    > Hello. We will upload your data to our blog if we don't hear back from you by Monday.

21. Message 021 From Victim Victim Date Not recorded

    > Thank you for your patience while we tried to get files to send. Can you decrypt these?

22. Message 022 From Victim Victim Date Not recorded

    > akira files.zip // 16.1 KB

23. Message 023 From Akira Actor / other Date Not recorded

    > We will upload them later.

24. Message 024 From Akira Actor / other Date Not recorded

    > [redacted].msc // 65.7 KB

25. Message 025 From Akira Actor / other Date Not recorded

    > [redacted].ps1 // 601 Bytes

26. Message 026 From Akira Actor / other Date Not recorded

    > [redacted].ps1 // 915 Bytes

27. Message 027 From Akira Actor / other Date Not recorded

    > [redacted].bat // 49 Bytes

28. Message 028 From Akira Actor / other Date Not recorded

    > The files are decrypted. We need to move to payment details.

29. Message 029 From Victim Victim Date Not recorded

    > Thank you for the files. We are reviewing our decryption needs and will reply soon.

30. Message 030 From Akira Actor / other Date Not recorded

    > We are waiting for your reply today.

31. Message 031 From Akira Actor / other Date Not recorded

    > Guys, your 600GB of data will be published soon, in case we don't have a reply from you within 12 hours.

32. Message 032 From Victim Victim Date Not recorded

    > Providing you an update that we are still here and working to get you an answer. Please stand by.

33. Message 033 From Akira Actor / other Date Not recorded

    > We hope so. We won't wait two more days.

34. Message 034 From Akira Actor / other Date Not recorded

    > So what's your decision? We're almost done with uploading.

35. Message 035 From Victim Victim Date Not recorded

    > Leadership has met, and we would like to explore negotiations and coming to an agreement on an amount. We are a small, private business and $250,000 is not a feasible amount for us to pay. We have very little capital, and we operate on loaned funds. Can you please bring your amount down somewhere closer to 5 digits? Our leadership is willing to pay.

36. Message 036 From Akira Actor / other Date Not recorded

    > Please stop trying to fool us. Your business able to pays the sum we ask. Show us an offer more than 5 digits and we will be able to settle this. We can move towards you and come down to $200,000.

37. Message 037 From Victim Victim Date Not recorded

    > We appreciate your willingness to negotiate, and we want to be clear that we are not trying to fool you. Any and all funds in our accounts have been borrowewd and is already expensed, meaning it does not belong to us. We would like to offer $90.000 based on what we believe we are able to pull together. We know this is lower than you expect, and please know we are truly doing our best to survive here. If we can pay this relatively quickly, would you accept this amount?

38. Message 038 From Akira Actor / other Date Not recorded

    > We need 6 figure proposal from you to finalize the deal. We're willing to accept 170,000 for the data we hold.

39. Message 039 From Victim Victim Date Not recorded

    > Thank you again for your continued willingness to work with us and understanding of our situation. 6-figures is difficult for us for the reasons we mentioned before. Let us see what we can do and we will provide you an update tomorrow or Tuesday. Can you confirm again what we receive if we pay you?

40. Message 040 From Akira Actor / other Date Not recorded

    > Once we agree on a price and receive payment, you will receive:

    1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.

41. Message 041 From Akira Actor / other Date Not recorded

    >

42. Message 042 From Akira Actor / other Date Not recorded

    > Standing by for a decent proposal on your part.

43. Message 043 From Victim Victim Date Not recorded

    > Our leadership met as a team over the weekend. They worked through all our options and were able to find $105,468. They have leveraged everything we have as a company. Please accept our offer, so that we can all move forward.

44. Message 044 From Akira Actor / other Date Not recorded

    > Hello. We're willing to accept $110,000 as a final. Here is the BTC wallet ID for payment: [redacted]

45. Message 045 From Victim Victim Date Not recorded

    > Thank you for your consideration. Our leadership is discussing now.

46. Message 046 From Akira Actor / other Date Not recorded

    > Any progress?

47. Message 047 From Akira Actor / other Date Not recorded

    > Well, your discussions take so much time. I am preparing your files for uploading to our blog. Tomorrow your data will be available for downloading.

48. Message 048 From Victim Victim Date Not recorded

    > We agree to pay the $110,000 to wallet [redacted], but we need time to get the funds together and bitcoin purchased. We would also like assurance that we will receive the following:

49. Message 049 From Victim Victim Date Not recorded

    > • Universal decryption tool and full decryption assistance.

50. Message 050 From Victim Victim Date Not recorded

    > • Evidence that you destroyed all copies of our data.

51. Message 051 From Victim Victim Date Not recorded

    > • Detailed security report about how you compromised our systems.

52. Message 052 From Victim Victim Date Not recorded

    > • Removal of our name from your website and guarantee not to publish or sell data.

53. Message 053 From Victim Victim Date Not recorded

    > • Guarantees not to attack us in the future.

54. Message 054 From Akira Actor / other Date Not recorded

    > You will surely receive everything you stated above. When can we expect the transfer?

55. Message 055 From Victim Victim Date Not recorded

    > We are heading into the weekend and need to work with our banks to get the funds. We can make the payment by early next week.

56. Message 056 From Akira Actor / other Date Not recorded

    > Ok. We can wait until Monday. Update me on your steps.

57. Message 057 From Akira Actor / other Date Not recorded

    > Any updates?

58. Message 058 From Victim Victim Date Not recorded

    > Thank you for reaching out. We had some issues today with getting the money released by our bank. We fully intend to follow through with payment, but may need another day.

59. Message 059 From Akira Actor / other Date Not recorded

    > You have 24 hours to sort this out. Otherwise, we will be forced to close this case.

60. Message 060 From Akira Actor / other Date Not recorded

    > Hello. Checking on your status.

61. Message 061 From Akira Actor / other Date Not recorded

    > We have received 0.00001 BTC. Standing by for the rest.

62. Message 062 From Victim Victim Date Not recorded

    > Thank you. We are working on sending the remaining amount now.

63. Message 063 From Victim Victim Date Not recorded

    > We have sent the payment. Please confirm you have received.

64. Message 064 From Akira Actor / other Date Not recorded

    > We have received the funds, thank you. Please wait for all the promised materials.

65. Message 065 From Akira Actor / other Date Not recorded

    > win_unlocker_[redacted].ex_ // 478 KB

66. Message 066 From Akira Actor / other Date Not recorded

    > logs_erase.rar // 6.99 MB

67. Message 067 From Akira Actor / other Date Not recorded

    > Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

68. Message 068 From Victim Victim Date Not recorded

    > Please send us instructions on how to use the decryptor.

69. Message 069 From Victim Victim Date Not recorded

    > We have tried running it against some files and it isn't working.

70. Message 070 From Akira Actor / other Date Not recorded

    > unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line

71. Message 071 From Victim Victim Date Not recorded

    > Please take our name off your website.

72. Message 072 From Akira Actor / other Date Not recorded

    > The post has been removed.