Akira — 20230929

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date Not recorded

   > now what?

2. Message 002 From Akira Actor / other Date Not recorded

   > Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization?

3. Message 003 From Victim Victim Date Not recorded

   > you took data? what, like you took files?

4. Message 004 From Akira Actor / other Date Not recorded

   > list.rar // 375 KB

5. Message 005 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

6. Message 006 From Victim Victim Date Not recorded

   > We have to pay too, yes?

7. Message 007 From Akira Actor / other Date Not recorded

   > Surely.

8. Message 008 From Victim Victim Date Not recorded

   > ok. what is the price? what do we get in return?

9. Message 009 From Akira Actor / other Date Not recorded

   > After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. You will receive a deletion log which means the raid drives that contained the only copy of your data are fully formatted and erased. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again.

   I will let you know the price shortly, we're reviewing your financial papers to come up with a reasonable demand to you.

10. Message 010 From Akira Actor / other Date Not recorded

    > So, we've gone through your files to define your financial abilities. We're willing to set a $300,000 price for ALL the services we offer:

    1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.

    Let me know whether you're interested in a whole deal or in parts.

11. Message 011 From Victim Victim Date Not recorded

    > ANy chance you would share the password for our VCenter? We fear the hardware has now been damaged

12. Message 012 From Akira Actor / other Date Not recorded

    > We didn't change the password for your VCenter.

13. Message 013 From Victim Victim Date Not recorded

    > well.. our creds do not work.. something is broke

14. Message 014 From Akira Actor / other Date Not recorded

    > Your VСenter was in the quality of a virtual machine on one of the ESXi server. All VMs on this ESXi have been encrypted so you can't login to your VCenter. After payment you will be able to access to any of your data/servers.

15. Message 015 From Victim Victim Date Not recorded

    > so the host password was changed?

16. Message 016 From Victim Victim Date Not recorded

    > VMs are encrypted or deleted?

17. Message 017 From Akira Actor / other Date Not recorded

    > Encrypted for sure.

18. Message 018 From Akira Actor / other Date Not recorded

    > The host password was changed, correct. You will get the pass after payment.

19. Message 019 From Victim Victim Date Not recorded

    > we need to know if the VMs are intact before we pay please...thus need limited access to the host

20. Message 020 From Akira Actor / other Date Not recorded

    > We can't provide, sorry. All we can offer you is to choose 2-3 encrypted files and upoad them to our chat so we can will upload decrypted copies back for you to be calm.

21. Message 021 From Victim Victim Date Not recorded

    > OK, Im not sure we will want to pay anything if we cant validate that the VMs are just encrypted vs. deleted or harmed in some other way. thanks

22. Message 022 From Victim Victim Date Not recorded

    > [redacted].jpg

23. Message 023 From Victim Victim Date Not recorded

    > [redacted]

24. Message 024 From Victim Victim Date Not recorded

    > [redacted].docx

25. Message 025 From Akira Actor / other Date Not recorded

    > We will provide these files soon. Also will you upload files for decryption?

26. Message 026 From Akira Actor / other Date Not recorded

    > [redacted]files.rar // 1.28 MB

27. Message 027 From Victim Victim Date Not recorded

    > what is the breakdown of pricing for the services--if we decide to pay?

28. Message 028 From Akira Actor / other Date Not recorded

    > Full decryption assistance costs 150k in your case, the evidence of data removal is 125k and the security report is 25k. All the guarantees are coming as a default.

29. Message 029 From Victim Victim Date Not recorded

    > ok

30. Message 030 From Akira Actor / other Date Not recorded

    > We need your decision.

31. Message 031 From Akira Actor / other Date Not recorded

    > We will put your name on our blog today.

32. Message 032 From Victim Victim Date Not recorded

    > as part of the local government, these decisions take everyone getting involved. This means things move slow

33. Message 033 From Akira Actor / other Date Not recorded

    > So everyone involved needs to hurry up. We won't wait long.

34. Message 034 From Victim Victim Date Not recorded

    > What is your best price?

35. Message 035 From Akira Actor / other Date Not recorded

    > For the whole deal?

36. Message 036 From Victim Victim Date Not recorded

    > yes. we are interested in the whole deal.

37. Message 037 From Akira Actor / other Date Not recorded

    > We would accept $250,000.

38. Message 038 From Victim Victim Date Not recorded

    > OK. i will share your offer with the board tonight or in the AM. Thanks

39. Message 039 From Akira Actor / other Date Not recorded

    > Hurry up on your part please.

40. Message 040 From Victim Victim Date Not recorded

    > Our board is at this level of approval: $137,000 - Monies over this amount have other local regulatory hurdles.

41. Message 041 From Akira Actor / other Date Not recorded

    > We will discuss internally.

42. Message 042 From Akira Actor / other Date Not recorded

    > The management has decided to accept your offer. I will provide you with a btc wallet ID shortly.

43. Message 043 From Akira Actor / other Date Not recorded

    > Here it is: [redacted] We expect to get payment within next 24 hours.

44. Message 044 From Victim Victim Date Not recorded

    > 24 hrs. yikes! we will do our best. thanks

45. Message 045 From Akira Actor / other Date Not recorded

    > We believe in you.

46. Message 046 From Victim Victim Date Not recorded

    > They said Monday is the soonest they can pay.

47. Message 047 From Akira Actor / other Date Not recorded

    > We will wait.

48. Message 048 From Akira Actor / other Date Not recorded

    > It is already Tuesday. If we don't receive payment within 24 hours, you will see your name in our blog. Your data will be uploaded before the weekend this way.

49. Message 049 From Akira Actor / other Date Not recorded

    > You can find yourself in our news column: https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/ If you want this post to be removed, we have to agree at something.

50. Message 050 From Victim Victim Date Not recorded

    > We cant gather funds as quickly as you like. Now that you have let evryone know it will be even more dificult to get funds. Why did you do this???

51. Message 051 From Akira Actor / other Date Not recorded

    > We can't read your thoughts. You left us almost 10 days ago and haven't dropped a word. Hurry up on your end. The post will be taken down immediately after payment.

52. Message 052 From Victim Victim Date Not recorded

    > Is the btc wallet still good to use?

53. Message 053 From Akira Actor / other Date Not recorded

    > Hello. Sure, you can use it.

54. Message 054 From Akira Actor / other Date Not recorded

    > When will we see the transfer? We won't be waiting for another week. We either publish your data prior to weekend or receive the payment and get this over.

55. Message 055 From Victim Victim Date Not recorded

    > whee is the best/proper place to purchase bitcoin?

56. Message 056 From Akira Actor / other Date Not recorded

    > C'mon guys. If you really wanted to pay, you would have done so a couple of weeks ago. Don't waste our time, please leave this chat. We absolutely do not care about this modest amount, so your data will be published soon.

57. Message 057 From Victim Victim Date Not recorded

    > where

58. Message 058 From Akira Actor / other Date Not recorded

    > You will know.