Akira — 20231217

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date Not recorded

   > I don't unnderstand what this is.

2. Message 002 From Akira Actor / other Date Not recorded

   > Hello. You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

3. Message 003 From Victim Victim Date Not recorded

   > Yes, I am the IT admin assitant.

4. Message 004 From Akira Actor / other Date Not recorded

   > listing_[redacted].txt // 724 KB

5. Message 005 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

   We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.

   Let me know whether you're interested in a whole deal or in parts. This will affect the final price. If we don't get a respond within next 24 hours, we will be forced to announce your corporate data leak on our blog.

6. Message 006 From Victim Victim Date Not recorded

   > I guess we need decryption assistance.

7. Message 007 From Akira Actor / other Date Not recorded

   > We'll let you know our price for the decryption tool soon.

8. Message 008 From Akira Actor / other Date Not recorded

   > We accept payments in bitcoins. To gain bitcoins you have to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. We are the ones who can properly decrypt your data and restore your infrastructure in a short period of time. After payment you will receive a decryptor for each of your systems and manual on how to use it for particular file/system. You will be able to restore your infrastructure within 24 hours. If you face any problems during decryption process, we will be here to support. You will receive a security report that includes information about how we were able to penitrate your network, as well as exclusive first-hand information about the state of your network, the vulnerabilities that we found. What's more, you'll receive high-quality technical recommendations on eliminating any vulnerabilities and strengthening your network to secure your internal and external infrastructure. You will also receive written guarantees that we will keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again. Our price is $200,000. Once you confirm the sum, I will drop off our wallet ID.

9. Message 009 From Akira Actor / other Date Not recorded

   > For $250,000 we will also delete your data.

10. Message 010 From Victim Victim Date Not recorded

    > can you show me these files: [redacted].doc [redacted].pdf [redacted].xlsx [redacted].xlsx [redacted].docx [redacted].docx

11. Message 011 From Victim Victim Date Not recorded

    > also here are some files for a test of the decryptor

12. Message 012 From Victim Victim Date Not recorded

    > [redacted].doc.akira // 1.86 MB

13. Message 013 From Victim Victim Date Not recorded

    > [redacted].pdf.akira // 115 KB

14. Message 014 From Victim Victim Date Not recorded

    > [redacted].xlsx.akira // 14.7 KB

15. Message 015 From Akira Actor / other Date Not recorded

    > Please wait.

16. Message 016 From Akira Actor / other Date Not recorded

    > files.rar // 4.29 MB

17. Message 017 From Akira Actor / other Date Not recorded

    > Here are the proof files.

18. Message 018 From Akira Actor / other Date Not recorded

    > [redacted].doc // 1.86 MB

19. Message 019 From Akira Actor / other Date Not recorded

    > [redacted].pdf // 115 KB

20. Message 020 From Akira Actor / other Date Not recorded

    > [redacted].xlsx // 14.2 KB

21. Message 021 From Akira Actor / other Date Not recorded

    > Here are the decrypted ones. Ready to move to payment?

22. Message 022 From Victim Victim Date Not recorded

    > Appreciated. We are scrambling to offer any amount as we are completely in unknown territory here. Can we reach a deal of 50,000? this is a lot of money for us.

23. Message 023 From Akira Actor / other Date Not recorded

    > We appreciate your offer but it is far away from a fair deal that we're here trying to reach. As a goodwill, we're willing to accept $200,000 which is capable for you to handle. You're well aware of the financial and reputational consequences in case we fail to agree. Let's be objective.

24. Message 024 From Victim Victim Date Not recorded

    > We understand and this is why we attempt with approval to offer 95,000 to reach the deal with you.

25. Message 025 From Akira Actor / other Date Not recorded

    > I'll discuss with my team and be back here.

26. Message 026 From Akira Actor / other Date Not recorded

    > So, we can accept $150,000 as final. We won't go any lower. Here is our BTC wallet [redacted] It's up to you.

27. Message 027 From Victim Victim Date Not recorded

    > We understand and agree to the 150,000 amount.

28. Message 028 From Victim Victim Date Not recorded

    > If you can confirm these deal points, then we have reached a deal -

29. Message 029 From Victim Victim Date Not recorded

    > 1. Decryptors right away, and full decryption assistance

30. Message 030 From Victim Victim Date Not recorded

    > 2. Confirmation of which files you exfiltrated – full file list

31. Message 031 From Victim Victim Date Not recorded

    > 3. Guarantees never to publish or sell our data – or to publicize or leak anything about this incident

32. Message 032 From Victim Victim Date Not recorded

    > 4. Guarantees never to attack us or our customers in the future

33. Message 033 From Victim Victim Date Not recorded

    > 5. Physical copy of all data exfiltrated – provide a link to download

34. Message 034 From Victim Victim Date Not recorded

    > 6. After we download the data, your evidence and secure proof data deletion

35. Message 035 From Victim Victim Date Not recorded

    > 7. Information about how you entered our systems – security report

36. Message 036 From Victim Victim Date Not recorded

    > 8. When we approve, you will delete this chat and all logs and other data about this incident

37. Message 037 From Victim Victim Date Not recorded

    > Please confirm and let us know when you are online to give us decryptors

38. Message 038 From Akira Actor / other Date Not recorded

    > We confirm. I'll provide our BTC wallet soon.

39. Message 039 From Akira Actor / other Date Not recorded

    > Here is the wallet: [redacted]

    How soon should we wait for a transfer? We expect to get payment before the weekend.

40. Message 040 From Akira Actor / other Date Not recorded

    > The terms we agreed on are valid before the weekend.

41. Message 041 From Victim Victim Date Not recorded

    > Confirmation is appreciated.

42. Message 042 From Victim Victim Date Not recorded

    > We will make the transfer this morning. Please prepare the decryptors to transfer to us right away

43. Message 043 From Victim Victim Date Not recorded

    > We see 2 wallets in chat. Please confirm we should transfer to lastest one: [redacted]

44. Message 044 From Akira Actor / other Date Not recorded

    > We're prepared.

45. Message 045 From Victim Victim Date Not recorded

    > OK, we will send shortly to wallet: [redacted], standby

46. Message 046 From Akira Actor / other Date Not recorded

    > Waiting.

47. Message 047 From Victim Victim Date Not recorded

    > transfer completed. you can check it

48. Message 048 From Akira Actor / other Date Not recorded

    > win_unlocker_[redacted].ex_ // 759 KB

49. Message 049 From Akira Actor / other Date Not recorded

    > unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line

50. Message 050 From Akira Actor / other Date Not recorded

    > We've started uploading your data to mega storage. This process will take us 2-3 days approximately.

51. Message 051 From Victim Victim Date Not recorded

    > Thanks, received. When will you provide the data dowload link?

52. Message 052 From Akira Actor / other Date Not recorded

    > See the message above.

53. Message 053 From Victim Victim Date Not recorded

    > yes, the chat did not refresh

54. Message 054 From Victim Victim Date Not recorded

    > Can we receive the security report and information about how you entered our systems

55. Message 055 From Akira Actor / other Date Not recorded

    > Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc.

56. Message 056 From Akira Actor / other Date Not recorded

    > mega.nz [redacted]@proton.me w[redacted]

    archive password: [redacted]

57. Message 057 From Victim Victim Date Not recorded

    > one of the files did not upload correctly can you please re-upload the file called [redacted].part6.rar

58. Message 058 From Akira Actor / other Date Not recorded

    > This file is correct. The downloading was interrupted and this archive was corrupted. We can't do anything with this.

59. Message 059 From Victim Victim Date Not recorded

    > so you cannot re-upload it again?

60. Message 060 From Victim Victim Date Not recorded

    > hello? the file in the mega one of the is not complete. You stopped the upload can you put it there again please and if something is wrong, can you say what files were there?

61. Message 061 From Akira Actor / other Date Not recorded

    > I've passed it to my team. Please wait.

62. Message 062 From Victim Victim Date Not recorded

    > Hello, how is this file re-upload progressing?

63. Message 063 From Akira Actor / other Date Not recorded

    > Hello. This archive cannot be re-uploaded because it was corrupted while we downloading this FROM your network. We got this archive like this. Sorry for misunderstanding.

64. Message 064 From Victim Victim Date Not recorded

    > Okay thanks for your help. Can you please delete all data you have about the situation and provide evidence of secure deletion?

65. Message 065 From Akira Actor / other Date Not recorded

    > Sure. I'll provide the file within 12 hours.

66. Message 066 From Akira Actor / other Date Not recorded

    > Deletion.7z // 87.3 KB

67. Message 067 From Akira Actor / other Date Not recorded

    > Apologies for the delay.