extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Babuk — 20210428

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 44 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Babuk
Record date
Apr 28, 2021
Messages
44
Participants
Babuk, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    hello, why did you decide to run audit of our company? I know, or secure is poor, because of we have faced to critical situations for last 3 years...

  2. Message 002 From Babuk Actor / other Date

    Hello. Do you understand it is a real attack or you do think it is just a penetration test? Do you understand that we have got a lot of essential data from your company? Also, do you understand that this data can compromise your company and CEO before the law?

  3. Message 003 From Victim Victim Date

    unfortunately, we expect, that this is attack, not penetration test. We need to negotiate. But the amount of 1 MIO USD is deathfull for our company

  4. Message 004 From Babuk Actor / other Date

    Okay. We made you an offer; if it doesn't fit you, you can offer your price. However, you need to know that we won't provide you a too big discount. Data we got is too sensible.

  5. Message 005 From Victim Victim Date

    you are right, data is sensible. But I don't know, which kind of information about our company you have? we have small company from Czech Republic. Not big corporation. We have poor financial results in last years due to pressure to decrease of margins in industry, Covid-19, now we face to Suez transport crisis... Youz can check our financial reports from available sources (for example - justice.cz)...

  6. Message 006 From Babuk Actor / other Date

    We know about your financial situation.We have all personal data of your employees and administrative staff, including private photos.Also, we have a full list of your clients, and I think you understand we can inform them about this incident. It will be a hard strike for your reputation.Also, we have got all information and documentation related to your projects, including schemes and drafts.We are still waiting for your price. We all realize that if this info will be uploaded to the public sources, you will lose much more.

  7. Message 007 From Victim Victim Date

    All the customers/client has been informed about this attack on [redacted]. So all of them know our situation. As well as all employees. We are in position of Tear 2 supplier = small supplier. All the clients data we have is not critical for them, not secret development data.

  8. Message 008 From Victim Victim Date

    Regarding our offer to start negotiate I have to contact our Board by phone to hear out their idea...

  9. Message 009 From Babuk Actor / other Date

    Okay. And what do you think about the GPDR?

  10. Message 010 From Babuk Actor / other Date

    Sure, contact anyone you need and return to us with your offer.

  11. Message 011 From Victim Victim Date

    Do you mean GDPR? In case if we will not be successful with negotiation, we will have to contact Police and The Office for Personal Data Protection. In case if we will make a deal, it will be only between us...

  12. Message 012 From Babuk Actor / other Date

    Yes, I am speaking exactly about it. If we make a deal, you avoid all the problems and we will got our money. Also, we are ready to inform you about used vulnerability to avoid such situation in future.

  13. Message 013 From Babuk Actor / other Date

    If not, all your data will remain encrypted and we will upload sensible info to public.

  14. Message 014 From Victim Victim Date

    I'm back. Before we will start to negotiate I have an order to provide you with company results for the last 3 years. Just to explain our position...

  15. Message 015 From Victim Victim Date

    year/sales/result:

  16. Message 016 From Victim Victim Date

    2018 / [redacted] 000 USD / [redacted] 000 USD (=loss)

  17. Message 017 From Victim Victim Date

    2019 / [redacted] 000 USD / [redacted] 000 USD (loss)

  18. Message 018 From Victim Victim Date

    2020 / [redacted] 000 USD / [redacted] 000 USD (profit)

  19. Message 019 From Babuk Actor / other Date

    Okay, we see

  20. Message 020 From Babuk Actor / other Date

    So, we are still waiting for your offer. I tell you about it third time already. One more - and we delete the chat and upload data

  21. Message 021 From Victim Victim Date

    Yeah. that is reality of our company which is available and you can check on official places... I can offer 10 000 USD (but have no any experience with BTC, how it works)

  22. Message 022 From Babuk Actor / other Date

    Depending on your serious situation, we can offer you a 50% discount. So, your price will be 500k

  23. Message 023 From Victim Victim Date

    500k CZK?

  24. Message 024 From Babuk Actor / other Date

    USD

  25. Message 025 From Babuk Actor / other Date

    If it is too hard, you can ask your shareholders to help

  26. Message 026 From Victim Victim Date

    sorry, this is unrealistic... That means to sold part of company or some of unused equipment...

  27. Message 027 From Babuk Actor / other Date

    Otherwise, you will try to find cash to avoid prison

  28. Message 028 From Babuk Actor / other Date

    We need to talk with business owners. Speaking with middleman is not interesting for us.

  29. Message 029 From Victim Victim Date

    unfortunately, that is my company position. As a CEO I have not so much authorization. From my position I can offer max. 23 246 USD (=500 000 CZK - that is my limit)

  30. Message 030 From Babuk Actor / other Date

    You can take a loan to pay this sum. Your offers is not even serious.

  31. Message 031 From Babuk Actor / other Date

    You have two days to pay, after this period, data will be posted and you won't be able to contact us anymore

  32. Message 032 From Victim Victim Date

    not realistic get any loan from Bank due to company summary results from the last years... In 2020 we had to sell some equipment to be able to survive... You have an experience with our IT infrastructure - you can see that's very poor solution. It's becase of we have no many, no chance for the bank loan... We try to survive from day to day... Please, take our situation in consideration.

  33. Message 033 From Babuk Actor / other Date

    We did it already. You can search for a recovery company in your country, they can offer you a loan in this situation. As I said already, we can make a discount, but your offer must be serious too.

  34. Message 034 From Victim Victim Date

    the statement of our shareholders is clear for me. My personal responsibility for the problem, my personal responsi

  35. Message 035 From Victim Victim Date

    ...responsibility for the solution. Due to my knowledge about this company for me is it the same "shit situation" to pay 0,5MIO CZK (as I have offered) or lost the data and start to re-build infrastructure and data again from zero. And in case If I will realize the payment, where is any guaranty that you are going to fulfill the deal? Is there any history about your BABYK group?

  36. Message 036 From Victim Victim Date

    All the customers, suppliers and employees know the situation in detail. They express their support to us.

  37. Message 037 From Babuk Actor / other Date

    This conversation have no sense now. We also have info about your shareholders, and I don't think they will be glad when it will be published. Anyway, you have the time to think about the situation and make us a good offer.

  38. Message 038 From Babuk Actor / other Date

    About your question - your guarantee is our reputation. Use Google to find info. We NEVER publish info and leave data encrypted if companies pay.

  39. Message 039 From Victim Victim Date

    And as you wrote before - to avoid to prison??? You have committed the crime - to steal data and you threaten to publish them. Not me - that is the law in CZ. No deal = I hav eto start to cooperate with Police and The Office for Personal Data Protection about your attack. I know you are far away from here and you don´t care...

  40. Message 040 From Victim Victim Date

    Your reputation? To attack the company using WinXP, Exchange 2007 and similar and ask 1 MIO USD? Sorry... it sounds like joke...

  41. Message 041 From Victim Victim Date

    On Google I see taht you evaluate the company basd on profile on zoominfo.com. Do you realy thing that company from [redacted location] in CZ has sales [redacted] 000 000 USD. I wish to be...

  42. Message 042 From Victim Victim Date

    https://www.google.com/maps/place/[redacted]?hl=cs-CZ

  43. Message 043 From Victim Victim Date

    This conversation doesn't lead to conclusion. Your expectation from this action is far away to our reality. Now, we have taken a decision to re-build the company IT structure starting tomorrow 29/04, 10:00 CET. Please, understand to your error that you have made with tip and attack small company, send to us decryptor and keep your reputation in your world. Be sure, if you are ready to "ruin our world", we are ready to build it again. From zero to hero. Thanks for the challenge.

  44. Message 044 From Victim Victim Date

    Ok tell us fast where we have to pay?