Akira — 20230815

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date Not recorded

   > Hello

2. Message 002 From Akira Actor / other Date Not recorded

   > Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

3. Message 003 From Victim Victim Date Not recorded

   > yes i do have permission

4. Message 004 From Akira Actor / other Date Not recorded

   > Ok, thank you. I will get back shortly with more information.

5. Message 005 From Victim Victim Date Not recorded

   > ok, We are here waiting.

6. Message 006 From Akira Actor / other Date Not recorded

   > We have to inform you that we are experiencing technical issues at the moment. All the details will be provided on Monday the latest. Our deepest apologies. Meanwhile, to prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

7. Message 007 From Victim Victim Date Not recorded

   > ok, will get those files for you. what is the amount you are asking?

8. Message 008 From Akira Actor / other Date Not recorded

   > List.txt // 9.56 MB

9. Message 009 From Akira Actor / other Date Not recorded

   > This is the list of files of [redacted] company. We are working on transporting files of the rest companies and will provide you with the lists for them soon. We're willing to set a $2,000,000 price for all the services we offer.

10. Message 010 From Victim Victim Date Not recorded

    > ok, thank you.

11. Message 011 From Victim Victim Date Not recorded

    > hi, when can we expect to receive the additional lists?

12. Message 012 From Akira Actor / other Date Not recorded

    > In a few hours.

13. Message 013 From Akira Actor / other Date Not recorded

    > [redacted]_full_listing.rar // 1.46 MB

14. Message 014 From Akira Actor / other Date Not recorded

    > This is everything we hold.

15. Message 015 From Akira Actor / other Date Not recorded

    > Given the fact that we hold data of two more companies, we've reconsidered the price for the full deal - $2,400,000. Let us know whether you are interested in a test decryption or files for proof. In case of quick payment we can make a discount.

16. Message 016 From Victim Victim Date Not recorded

    > pulling down the listings now. appreciate your patience.

17. Message 017 From Akira Actor / other Date Not recorded

    > Let us know if you are interested in a test decryption and proof files. Waiting for your answer tomorrow.

18. Message 018 From Victim Victim Date Not recorded

    > ok, we are working on your requests. Please allow us sometime to review the file listing and send requested files.

19. Message 019 From Akira Actor / other Date Not recorded

    > Please keep in mind that tight cooperation with us often leads to a more positive end of a deal.

20. Message 020 From Akira Actor / other Date Not recorded

    > We are waiting for your decision today.

21. Message 021 From Victim Victim Date Not recorded

    > We are looking through all the file listings you gave us. We will get you some files soon. appreciate your patience.

22. Message 022 From Akira Actor / other Date Not recorded

    > Do not forget about files for the test decryption, if you need it.

23. Message 023 From Victim Victim Date Not recorded

    > Definitely apprecaite your patience. My team is highly stressed due to the incident, and are working to get you the files as soon as possible.

24. Message 024 From Akira Actor / other Date Not recorded

    > Speed things up on your part and nothing bad will happen.

25. Message 025 From Victim Victim Date Not recorded

    > ok noted, will make sure pass this information along to my boss.

26. Message 026 From Akira Actor / other Date Not recorded

    > If we don't get your decision within next 24 hours, we will be forced to announce your corporate data leak on our blog.

27. Message 027 From Victim Victim Date Not recorded

    > [redacted].edi.[redacted] // 793 Bytes

28. Message 028 From Victim Victim Date Not recorded

    > [redacted].edi.[redacted] // 1.42 KB

29. Message 029 From Victim Victim Date Not recorded

    > [redacted].edi.[redacted] // 23.4 KB

30. Message 030 From Victim Victim Date Not recorded

    > [redacted].csv.[redacted] // 74.8 KB

31. Message 031 From Victim Victim Date Not recorded

    > [redacted].csv.[redacted] // 1.1 KB

32. Message 032 From Victim Victim Date Not recorded

    > Definitely appreciate your patience and working with us. We have almost completed going through the file listing and will provide you files soon. While we finish that, can you please decrypt these files.

33. Message 033 From Akira Actor / other Date Not recorded

    > Yes, I've passed the files to my tech dept. Please wait.

34. Message 034 From Akira Actor / other Date Not recorded

    > files.zip // 14.8 KB

35. Message 035 From Akira Actor / other Date Not recorded

    > Here they are. Please check.

36. Message 036 From Victim Victim Date Not recorded

    > thanks, pulling these down for review. will provide an update when we can.

37. Message 037 From Akira Actor / other Date Not recorded

    > We have to close the deal this week. Are you in time?

38. Message 038 From Victim Victim Date Not recorded

    > We are working as fast as we can. we really appreciate your patience with us during all of this. After reviewing the file listings can you provide the following files please.

39. Message 039 From Victim Victim Date Not recorded

    > Backlog detail 2021.xlsx, [redacted] Rate 10.24-10.28.22.xlsx, Keywords.xlsx, [redacted] Inspection Log 2023.xlsx, img20230508_[redacted].pdf, [redacted] Tax Codes.pdf, Interest Payment [redacted].pdf, Sales Service Agreement.docx, Annual Refiling Survey [redacted].pdf, [redacted] - Aug Insurance Exp [redacted].xls, [redacted] - Accrue Deprec for [redacted].xls, [redacted] - Clear Obsolete Inventory [redacted].xls, [redacted] - Loss on Sale & Liquidation of Assets [redacted].xls, [redacted].xls, [redacted].PDF, [redacted] Tests.xlsx, [redacted].PDF, [redacted].PDF

40. Message 040 From Akira Actor / other Date Not recorded

    > Too many files but ok. We will provide shortly. Meanwhile, how's it going with fund gathering?

41. Message 041 From Akira Actor / other Date Not recorded

    > [redacted].rar // 3.12 MB

42. Message 042 From Akira Actor / other Date Not recorded

    > You can review the files.

43. Message 043 From Victim Victim Date Not recorded

    > When reviewing the decrypted files you sent back, we noticed that 2 of them are not what we expected to see as they came back with some empty fields. Can you please decrypt the attached files again and send it back to us so we are able to confirm the decryptability. Appreciate you working with us.

44. Message 044 From Victim Victim Date Not recorded

    > [redacted].csv.[redacted] // 74.8 KB

45. Message 045 From Victim Victim Date Not recorded

    > [redacted].csv.[redacted] // 1.1 KB

46. Message 046 From Akira Actor / other Date Not recorded

    > We will check but we actually have some doubts that they are corrupted. If it is an attempt to win more time, nothing good will happen. Please wait.

47. Message 047 From Akira Actor / other Date Not recorded

    > The files are ok. In 24 hours we will announce your corporate data leak on your blog. Early next week your data will be published. Thank you.

48. Message 048 From Victim Victim Date Not recorded

    > We are not stalling for time, we are wanting to make sure that the decryption process brings back the data in its entirety. The 2 files we are asking about it appears that it dropped fields off at the end of the files.

49. Message 049 From Akira Actor / other Date Not recorded

    > I'll ask to double check but bear in mind that we are posting you in our blog tomorrow if there is no payment decision from you.

50. Message 050 From Victim Victim Date Not recorded

    > We had very good backups and only about 1/4 of our data is encrypted now. We have approval to pay you $800k tomorrow for decryptors, proof of data deletion, and security audit report. Leaking our name will make our ability to pay much harder. Please accept so we can put this behind us.

51. Message 051 From Akira Actor / other Date Not recorded

    > We appreciate this offer but all we can do is to give you 20% discount in such circumstances.

52. Message 052 From Akira Actor / other Date Not recorded

    > I have very good news. I was talking to the upper management and they are willing to accept $1,4M today for all the outlined options. On Monday we will have to return to our previous demand. Do we have a deal now?

53. Message 053 From Akira Actor / other Date Not recorded

    > So, I passed your request regarding those files to the tech department. After decryption these same files were increased in size and then re-encrypted. After decryption, the files remained the same size, which means that our decryptor absolutely works correctly. It also means that you tried to play unfairly and gain more time. We also doubt your stories about "good backups".

    Based on all of the above, our offer of $1.4 million when paid today still stands, but we will not accept anything below $2 million on Monday. If you refuse and break the deal, we will simply publish your stuff and forget about you.

54. Message 054 From Victim Victim Date Not recorded

    > Thank you so much for working with us. In good faith we are going to reveal to you that we only have $1,000,000 to work with. We can pay you all of that today. To get any more will be very hard and take many more days. Please accept $1 million and we will get that to you today

55. Message 055 From Akira Actor / other Date Not recorded

    > Please wait.

56. Message 056 From Akira Actor / other Date Not recorded

    > Ok, the leadership has approved that number. Here is a BTC wallet ID for payment: [redacted]

57. Message 057 From Akira Actor / other Date Not recorded

    > How soon are you able to make a transfer?

58. Message 058 From Victim Victim Date Not recorded

    > We are wiring the money to a broker now. They say a couple hours

59. Message 059 From Akira Actor / other Date Not recorded

    > Ok, standing by.

60. Message 060 From Victim Victim Date Not recorded

    > To confirm we pay you $1,000,000, and you will deliver whole network decryptors for linux, and windows, promise to not publish or sell our data, provide proof of deletion, and a security audit report?

61. Message 061 From Akira Actor / other Date Not recorded

    > We do confirm the terms.

62. Message 062 From Victim Victim Date Not recorded

    > and guarantees not to attack us in the future

63. Message 063 From Akira Actor / other Date Not recorded

    > Sure.

64. Message 064 From Victim Victim Date Not recorded

    > thank you. sending bitcoin shortly

65. Message 065 From Akira Actor / other Date Not recorded

    > Standing by.

66. Message 066 From Victim Victim Date Not recorded

    > We just sent a test transaction. Please verify and we will send the rest

67. Message 067 From Victim Victim Date Not recorded

    > Test transaction confirmed on blockchain. Please verify

68. Message 068 From Victim Victim Date Not recorded

    > Hello?

69. Message 069 From Victim Victim Date Not recorded

    > We will be back in east coast usa morning to send you the rest

70. Message 070 From Akira Actor / other Date Not recorded

    > Hello. We have received 0.0001 BTC.

71. Message 071 From Victim Victim Date Not recorded

    > Thank you. Are you ready to receive the rest?

72. Message 072 From Victim Victim Date Not recorded

    > sending the rest

73. Message 073 From Victim Victim Date Not recorded

    > Coin sent. Txid: [redacted]

74. Message 074 From Akira Actor / other Date Not recorded

    > We have received, thank you. Please wait for the decryptor first.

75. Message 075 From Akira Actor / other Date Not recorded

    > We will provide everything within 24 hours. Thank you for your patience.

76. Message 076 From Victim Victim Date Not recorded

    > Thank you for update. We will continue to nervously wait

77. Message 077 From Victim Victim Date Not recorded

    > Just checking. Please provide what you promised soon

78. Message 078 From Akira Actor / other Date Not recorded

    > decrypt.zip // 479 KB

79. Message 079 From Akira Actor / other Date Not recorded

    > decrypt.exe Name: decrypt

    Usage: cli args

    Flags: --path: Start path --secret: Private key --logs: Print logs. Valid values for: trace, debug, error, info, warn. Default: off -h, --help: Show help ----------------------------------------------------------- Build information: Version: 2023.9.5 SECRET KEY: "[redacted]" ----------------------------------------------------------- decrypt.exe --path --secret: Private key --logs ---- decrypt.exe --path C:\ --secret [redacted] --logs trace decrypt.exe --secret [redacted] --logs trace

80. Message 080 From Victim Victim Date Not recorded

    > thank you we are working on this now. can you provide a security report or how you got in and what we need to do better?

81. Message 081 From Akira Actor / other Date Not recorded

    > Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate:

    1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc.

    We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security. The evidence of data removal will be provided soon.

82. Message 082 From Victim Victim Date Not recorded

    > Thank you. We wait for proof of deletion.

83. Message 083 From Akira Actor / other Date Not recorded

    > [redacted] dellogs.rar // 524 KB

84. Message 084 From Akira Actor / other Date Not recorded

    > There are three files in the archive.