Akira — 20250423

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date Not recorded

   > hi how much for decryption?

2. Message 002 From Akira Actor / other Date Not recorded

   > Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.

3. Message 003 From Victim Victim Date Not recorded

   > yes

4. Message 004 From Akira Actor / other Date Not recorded

   > List.7z // 141 KB

5. Message 005 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10 MB each from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10 MB each to our chat and we will upload decrypted copies back. We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

6. Message 006 From Victim Victim Date Not recorded

   > we need the decryptor. evidence of data removal, and guarantee to not publish or sell data

7. Message 007 From Akira Actor / other Date Not recorded

   > We will let you know the price soon.

8. Message 008 From Akira Actor / other Date Not recorded

   > We're willing to set a $600,000 price for ALL the services we offer. We accept payments in BTC. To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. Do you have any file requests?

9. Message 009 From Akira Actor / other Date Not recorded

   > Are you going to work with us?

10. Message 010 From Victim Victim Date Not recorded

    > yes. the VMs are encrypted so hard time to get to the file to provide sample.

11. Message 011 From Victim Victim Date Not recorded

    > can we give you a directory and file name and you can provide the file as proof of possession?

12. Message 012 From Akira Actor / other Date Not recorded

    > Yes, please do asap.

13. Message 013 From Victim Victim Date Not recorded

    > yes, the team is looking at the list to pick out file to show proof of possession.

14. Message 014 From Akira Actor / other Date Not recorded

    > Any success?

15. Message 015 From Victim Victim Date Not recorded

    > yes, they are sending directories to me soon and i will send to you.

16. Message 016 From Victim Victim Date Not recorded

    > F:\[redacted].com\unpack\[redacted].docx

17. Message 017 From Victim Victim Date Not recorded

    > F:\[redacted].com\unpack\[redacted].pdf

18. Message 018 From Victim Victim Date Not recorded

    > F:\[redacted].com\unpack\[redacted].csv

19. Message 019 From Victim Victim Date Not recorded

    > F:\[redacted].com\unpack\[redacted].html

20. Message 020 From Victim Victim Date Not recorded

    > hello? we are ready to work with you for payment.

21. Message 021 From Akira Actor / other Date Not recorded

    > files.rar // 214 KB

22. Message 022 From Akira Actor / other Date Not recorded

    > You can review. Do you want to test our decryption tool before payment?

23. Message 023 From Victim Victim Date Not recorded

    > yes, can we test the decryption tool?

24. Message 024 From Akira Actor / other Date Not recorded

    > Sure. Provide the files today.

25. Message 025 From Akira Actor / other Date Not recorded

    > Hello. Have you managed to gather files?

26. Message 026 From Victim Victim Date Not recorded

    > sorry. this site was offline for a while

27. Message 027 From Akira Actor / other Date Not recorded

    > Now it is on. Where are the files?

28. Message 028 From Victim Victim Date Not recorded

    > how much for just evidence of data deletion and not leaing data?

29. Message 029 From Victim Victim Date Not recorded

    > we will pay

30. Message 030 From Akira Actor / other Date Not recorded

    > $320,000 for the rest options.

31. Message 031 From Victim Victim Date Not recorded

    > No cyber insurance. Can you work with us? can we do $35,000? We can get you paid today if so.

32. Message 032 From Akira Actor / other Date Not recorded

    > No. You have to be serious. $35,0000 won't work at all. Please reconsider asap.

33. Message 033 From Victim Victim Date Not recorded

    > yea. just evidence of deletion and not leaking data. what about $95000?

34. Message 034 From Akira Actor / other Date Not recorded

    > $260,000 if you pay today.

35. Message 035 From Victim Victim Date Not recorded

    > we can do $155,000 today.

36. Message 036 From Akira Actor / other Date Not recorded

    > $220,000 today. Here is our BTC wallet [redacted]. Let us know when you are ready to make payment.

37. Message 037 From Victim Victim Date Not recorded

    > we can't do 220K. we're already loss of business because you entrypted us and we are shut down. let's get you paid. $160,000 today.

38. Message 038 From Akira Actor / other Date Not recorded

    > Don't tell us stories. $200,000 is the lowest we can accept. Take it or leave it.

39. Message 039 From Victim Victim Date Not recorded

    > it's the truth but we want this over with. let's meet in the middle at $180k. say yes and we are sending to [redacted]

40. Message 040 From Akira Actor / other Date Not recorded

    > Guys, we've already reduced the price significantly. $200,000 is the lowest possible.

41. Message 041 From Victim Victim Date Not recorded

    > yes and we appreciate it. let me check to make sure we can do that.

42. Message 042 From Victim Victim Date Not recorded

    > ok. we are buying the BTC to send over.

43. Message 043 From Akira Actor / other Date Not recorded

    > What's your progress?

44. Message 044 From Victim Victim Date Not recorded

    > we'll have it today. delay with bank. we will let you know when we are sending. we will first send a smaller amount to confirm receipt.

45. Message 045 From Akira Actor / other Date Not recorded

    > Standing by. Thank you.

46. Message 046 From Victim Victim Date Not recorded

    > still waiting on bank. thank you for your patience

47. Message 047 From Akira Actor / other Date Not recorded

    > Waiting.

48. Message 048 From Victim Victim Date Not recorded

    > yep we are still waiting on bank transfers to complete

49. Message 049 From Akira Actor / other Date Not recorded

    > Keep us posted.

50. Message 050 From Victim Victim Date Not recorded

    > will do. still waiting on bank

51. Message 051 From Akira Actor / other Date Not recorded

    > Any success?

52. Message 052 From Victim Victim Date Not recorded

    > yea, we have the money. purchasing BTC now. can you resend your wallet again? we will send $500 first to make sure you get it. then we will send the rest.

53. Message 053 From Victim Victim Date Not recorded

    > $500 sent to [redacted]. Confirm reciept.

54. Message 054 From Akira Actor / other Date Not recorded

    > 0.005 received. You can proceed with the full amount.

55. Message 055 From Victim Victim Date Not recorded

    > how will you provide evidence of data deletion?

56. Message 056 From Victim Victim Date Not recorded

    > can with get video evidence of data deletion?

57. Message 057 From Akira Actor / other Date Not recorded

    > You will receive a deletion log which means the raid drives that contained the only copy of your data are fully formatted and erased.

58. Message 058 From Victim Victim Date Not recorded

    > and guarantee that no data is leaked?

59. Message 059 From Akira Actor / other Date Not recorded

    > Sure. Guarantees will be provided as well. Are you going to send the rest?

60. Message 060 From Victim Victim Date Not recorded

    > yes, sending now.

61. Message 061 From Victim Victim Date Not recorded

    > the send is under review.

62. Message 062 From Victim Victim Date Not recorded

    > rest of the money has been sent over. please provide deletion logs.

63. Message 063 From Akira Actor / other Date Not recorded

    > Received. Please wait.

64. Message 064 From Akira Actor / other Date Not recorded

    > Deletion.7z // 316 KB

65. Message 065 From Akira Actor / other Date Not recorded

    > Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.