Akira — 20240129

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date Not recorded

   > Hello there

2. Message 002 From Victim Victim Date Not recorded

   > Anyone there

3. Message 003 From Victim Victim Date Not recorded

   > How do we obtain a recovery key?

4. Message 004 From Victim Victim Date Not recorded

   > akira_readme.txt // 2.68 KB

5. Message 005 From Victim Victim Date Not recorded

   > HELLLOOOO!!!!

6. Message 006 From Akira Actor / other Date Not recorded

   > Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.

   Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

7. Message 007 From Victim Victim Date Not recorded

   > Yes

8. Message 008 From Akira Actor / other Date Not recorded

   > list.txt // 208 KB

9. Message 009 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.

   We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.

   Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

10. Message 010 From Victim Victim Date Not recorded

    > Whole data

11. Message 011 From Victim Victim Date Not recorded

    > Hello

12. Message 012 From Victim Victim Date Not recorded

    > Hello

13. Message 013 From Victim Victim Date Not recorded

    > Hello

14. Message 014 From Victim Victim Date Not recorded

    > Hello

15. Message 015 From Victim Victim Date Not recorded

    > Hello

16. Message 016 From Victim Victim Date Not recorded

    > Hello

17. Message 017 From Akira Actor / other Date Not recorded

    > Wait a bit.

18. Message 018 From Victim Victim Date Not recorded

    > Hello

19. Message 019 From Akira Actor / other Date Not recorded

    > So, we've gone through your files to define your financial abilities. We're willing to set a $275,000 price for ALL the services we offer.

20. Message 020 From Victim Victim Date Not recorded

    > i would like to appeal to you. We are a small company of only 5 employees. We are willing to pay, we just need this to be a resonable amount that we can afford to pay without going bankrupt. Please reconsider and we will like to work with you.

21. Message 021 From Victim Victim Date Not recorded

    > We have to pay out of pocket, we do not have any insurance for this.

22. Message 022 From Akira Actor / other Date Not recorded

    > Show me what do you have now and I'll talk to my team.

23. Message 023 From Victim Victim Date Not recorded

    > i have 50K i can spend now.

24. Message 024 From Akira Actor / other Date Not recorded

    > We won't be able to settle this at 50k. I think the best we can offer is a 50k discount but I need to talk to my team. We work with 6 figures only.

25. Message 025 From Victim Victim Date Not recorded

    > if you can work with 6 figures can you do 100K? i dont have that cash at the moment but i can get a loan. Can we start with a few VMs to prove it works?

26. Message 026 From Akira Actor / other Date Not recorded

    > $175,000 and we will get this over. We can't go any lower. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 mb each to our chat and we will upload decrypted copies back.

27. Message 027 From Victim Victim Date Not recorded

    > please reconsider. can you take 125K? it will be a struggle at that price for us.

28. Message 028 From Akira Actor / other Date Not recorded

    > Guys, first of all, 100k discount seems huge enough. Secondly, we've set a fair price initially, so you can handle that with no problem. Let 175k be the final number since this way both of us are satisfied.

29. Message 029 From Victim Victim Date Not recorded

    > how long can you give us to come up with the money?

30. Message 030 From Akira Actor / other Date Not recorded

    > The discount is available till Saturday.

31. Message 031 From Victim Victim Date Not recorded

    > can you tell us how we need to go about paying you?

32. Message 032 From Akira Actor / other Date Not recorded

    > We accept payments in bitcoins. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.

33. Message 033 From Akira Actor / other Date Not recorded

    > Let me know when you are ready and I'll provide our wallet id.

34. Message 034 From Victim Victim Date Not recorded

    > Hold on. My team is working with the finance department to see what additional funding (if any) we are able to come up with. In the meantime we have some additional questions. Can you provide the following files (below), let us know how much data was taken, and is the file list you provided a full file list? E:\[redacted].pdf E:\[redacted].pdf E:\[redacted].pdf E:\[redacted].pdf E:\[redacted].pdf E:\[redacted]3.pdf E:\[redacted].pdf

35. Message 035 From Akira Actor / other Date Not recorded

    > This is the complete list. We have about 2gb of data. The files will be provided shortly.

36. Message 036 From Victim Victim Date Not recorded

    > Our finance department needs additional time to see if they can find additional funding, we will need a few more days. But I will keep you updated as much as possible.

37. Message 037 From Akira Actor / other Date Not recorded

    > Make everything ready by Tuesday. We'll close the deal.

38. Message 038 From Akira Actor / other Date Not recorded

    > files.rar // 711 KB

39. Message 039 From Akira Actor / other Date Not recorded

    > You can review the files.

40. Message 040 From Victim Victim Date Not recorded

    > downloading now and will review with my team. can you decrypt these files for me.

41. Message 041 From Victim Victim Date Not recorded

    > encrypted.zip // 19 KB

42. Message 042 From Akira Actor / other Date Not recorded

    > I'll upload them decrypted soon.

43. Message 043 From Akira Actor / other Date Not recorded

    > decrypted.zip // 9.88 KB

44. Message 044 From Akira Actor / other Date Not recorded

    > You can check the files.

45. Message 045 From Victim Victim Date Not recorded

    > thank you, downloading these now. i will keep you updated.

46. Message 046 From Victim Victim Date Not recorded

    > After careful consideration and very extensive discussions, we have reached our maximum budget capacity of $135,000. It's important to understand that this figure already stretches our financial limits well beyond the available funding. The amount we're proposing is a significant six-figure sum that we are paying out of our personal pockets. Please accept! we can make payment immediately. Please recognize our constraints and work with us.

47. Message 047 From Akira Actor / other Date Not recorded

    > We see your intentions to resolve this so we can accept $150,000 and close the deal. There is a little gap between us and I think there shouldn't be a problem for you. Here is our BTC wallet [redacted]. Let me know how soon can we expect the transfer.

48. Message 048 From Victim Victim Date Not recorded

    > We appreciate the additional discount. However we explained to you our financial situation and we cannot come up with that amount. I have been authorized to offer you 140k. Any more than that amount will put us out of business. It is still a significant six figure payment to you. Please accept, and let’s both walk away happy.

49. Message 049 From Akira Actor / other Date Not recorded

    > ok you can send $140k to the same wallet from my previous message. How soon can we expect the transfer?

50. Message 050 From Victim Victim Date Not recorded

    > Just to confirm we pay you $140,000 to BTC wallet [redacted] today, in return we will receive whole network decryptors, a deleteion log showing you deleted our data from your servers, a security audit report in detail on how you attacked us, a promise to never attack our company again, and the Domain Admin password to our AD environment to begin recovery as it was changed and we cannot login.

51. Message 051 From Akira Actor / other Date Not recorded

    > We confirm the terms and the wallet id [redacted]

52. Message 052 From Victim Victim Date Not recorded

    > thank you, we are preparing to send.

53. Message 053 From Victim Victim Date Not recorded

    > payment has been sent

54. Message 054 From Victim Victim Date Not recorded

    > https://mempool.space/tx/[redacted]

55. Message 055 From Akira Actor / other Date Not recorded

    > Received. Please wait.

56. Message 056 From Akira Actor / other Date Not recorded

    > unlocker.7z // 1.77 MB

57. Message 057 From Akira Actor / other Date Not recorded

    > unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line ESXi commands 1) chmod +x unlocker 2)./unlocker -p="/vmfs/volumes"

58. Message 058 From Akira Actor / other Date Not recorded

    > You will receive the rest within 24 hours.

59. Message 059 From Victim Victim Date Not recorded

    > can you give us the domain admin password? we are unable to login

60. Message 060 From Akira Actor / other Date Not recorded

    > Yes. Please wait.

61. Message 061 From Victim Victim Date Not recorded

    > we are having issues with a large file. it is 5.3tb the error is below

62. Message 062 From Victim Victim Date Not recorded

    > file_logger error Open file with share check!

63. Message 063 From Akira Actor / other Date Not recorded

    > I'll pass this to my team. Pleas wait.

64. Message 064 From Victim Victim Date Not recorded

    > can you provide the domain admin login

65. Message 065 From Akira Actor / other Date Not recorded

    > net user [redacted] [redacted] /dom net user [redacted] [redacted] /dom

66. Message 066 From Victim Victim Date Not recorded

    > thank you. additionally we were able to decrypt the large file without error. when can we expect to receive the remaining deliverables?

67. Message 067 From Akira Actor / other Date Not recorded

    > You will receive it within next 24 hours. Sorry for delay.

68. Message 068 From Victim Victim Date Not recorded

    > okay thank you

69. Message 069 From Akira Actor / other Date Not recorded

    > log_erase [redacted].txt // 2.06 KB

70. Message 070 From Akira Actor / other Date Not recorded

    > Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate:

    1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc.

    We guarantee that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again.

    We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.