extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

fog — 20240729

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 144 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
fog
Record date
Jul 29, 2024
Messages
144
Participants
fog, victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From victim Victim Date

    Hi

  2. Message 002 From fog Actor / other Date

    hi

  3. Message 003 From fog Actor / other Date

    I will give you details in a minute

  4. Message 004 From fog Actor / other Date

    [provides a plain TXT files list] this is what has been taken from your network

  5. Message 005 From victim Victim Date

    What are the instruction to restore our data?

  6. Message 006 From victim Victim Date

    Hi are you there?

  7. Message 007 From fog Actor / other Date

    I will give you instructions after payment

  8. Message 008 From victim Victim Date

    What payment?

  9. Message 009 From fog Actor / other Date

    If you want your data fully decrypted and the files we stole removed from our source, you will have to pay a fee. We will also be able to provide a security report and explain how we did it to get in. I will give you our demand soon.

  10. Message 010 From victim Victim Date

    Any news?

  11. Message 011 From fog Actor / other Date

    If you need a proof we indeed possess your data, send me a couple of directories to the files you want to see. To test our tool, send me 3 random encrypted files and we will decrypt them for free. Our demand is $200,000.

  12. Message 012 From victim Victim Date

    Hello, we don't know how to make the payment or how to facilitate it for you. On the other hand, we are a very small company and cannot afford the payment you are mentioning. What options do we have? And about the three files what is the procedure?

  13. Message 013 From fog Actor / other Date

    As for the files, if you need a proof we indeed possess your data, send me a couple of directories to the files you want to see. We can provide you with a $20,000 discount if you pay us this week. The price is fair for your company.

  14. Message 014 From victim Victim Date

    We are willing to cooperate, but the amount requested is far beyond our capabilities as a small company. We can offer a smaller sum and pay it as soon as possible. Additionally, we need to clearly understand the payment process and the guarantees we have to securely recover our data. Please provide detailed instructions on how to proceed and assure us that we will receive all our data without further issues

  15. Message 015 From fog Actor / other Date

    I can't give you an additional discount until I see your number. The price can be increased at any second if you keep haggling like this.

  16. Message 016 From victim Victim Date

    What number do you mean?

  17. Message 017 From fog Actor / other Date

    The number you are ready to pay at the moment.

  18. Message 018 From victim Victim Date

    We can offer $120,000 and want to be transparent, avoiding a prolonged negotiation. Additionally, we need to understand how to make the payment. We will provide several files for you to decrypt to verify your capabilities.

  19. Message 019 From fog Actor / other Date

    $120,000 is not a bad offer but I can't accept this. I also want to avoid a prolonged negotiation, so our final price is $150,000. You have 2 days to gather the rest $30k and we will be done with it. I will give you our wallet for payment later.

  20. Message 020 From victim Victim Date

    We are agreeable to proceeding with the following conditions: First, we will provide several encrypted files for you to decrypt as proof of your decryption capabilities. Following this, we will make an initial payment of $120,000 in exchange for the instructions and necessary tools to decrypt the rest of our systems. Once we have successfully recovered our data, we will make a final payment of $30,000. In return, we expect a report detailing how the attack was carried out and confirmation that all our data has been removed from your possession and any related systems

  21. Message 021 From victim Victim Date

    [provides a zip archive of encrypted files]

  22. Message 022 From fog Actor / other Date

    tell is there the file named "auth.log.fog.savepoint" somewhere near the file "auth.log.fog"?

  23. Message 023 From victim Victim Date

    We couldn't find the file you mentioned, could you tell us where this file should be located and what it contains?

  24. Message 024 From fog Actor / other Date

    it should be in the same directory with the file auth.log.fog that your gave me

  25. Message 025 From victim Victim Date

    Isn't in this directory

  26. Message 026 From fog Actor / other Date

    [provides 2 decrypted files] I will give you everything right away when I received the full 150k payment. Let's resolve the issue quickly.

  27. Message 027 From fog Actor / other Date

    [redacted] this is id for payment

  28. Message 028 From victim Victim Date

    We understand your position, but we must adhere to our agreed-upon model. We need to follow the steps we outlined previously: first providing a portion of the payment, receiving the necessary decryption instructions, and then completing the full payment upon confirmation. Additionally, specify which cryptocurrency it is for the payment.

  29. Message 029 From fog Actor / other Date

    We work with bitcoins. We cannot violate our policy, which means we cannot accept fractional payments.

  30. Message 030 From victim Victim Date

    Once the payment is made, how does the decryption process work? What guarantees do we have that all our data will be fully recovered and secured? We also want to understand what you will provide to us after the payment. Please understand that we are concerned due to our lack of experience with situations like this and need reassurance that everything will be resolved properly.

  31. Message 031 From fog Actor / other Date

    Once the payment is made, you will get the.exe files that you will need to run on your systems (win or esxi) to decrypt your files. We guarantee that you will be able to recover all the encrypted data. We will give you a deletion log file which means the files we stole.were removed from our source.

  32. Message 032 From victim Victim Date

    We need to finalize the financial and legal aspects on our end before proceeding with the payment. Once everything is ready and the payment is made, we will notify you immediately.

  33. Message 033 From fog Actor / other Date

    Standing by, thanks.

  34. Message 034 From victim Victim Date

    We are currently reviewing the payment method, and since we are not familiar with this process, we are unsure how to proceed. Could you explain how this is typically done and which services are usually used? We want to ensure that everything is handled correctly.

  35. Message 035 From fog Actor / other Date

    see the link https://www.csoonline.com/article/570047/how-to-buy-bitcoin-for-ransomware-payment-if-you-must.html

  36. Message 036 From victim Victim Date

    Thanks,we are checking, but the registration process and validation will take some time.

  37. Message 037 From fog Actor / other Date

    sure

  38. Message 038 From fog Actor / other Date

    How's your progress with that?

  39. Message 039 From victim Victim Date

    The cryptocurrency purchase platform needs to verify the user, and this won't be completed until tomorrow. The process is turning out to be quite long and complex for us.

  40. Message 040 From fog Actor / other Date

    tell me when you have updates

  41. Message 041 From victim Victim Date

    Sure

  42. Message 042 From victim Victim Date

    We have conducted an initial test to verify that the process we're following is correct. Could you confirm that you have received the first transfer of $5? Meanwhile, we are in the process of acquiring the total amount of cryptocurrency needed for the full payment, but it is taking some time.

  43. Message 043 From fog Actor / other Date

    I received 0.000082

  44. Message 044 From victim Victim Date

    Okay, we are in the process of obtaining the full amount. Once we have it, we will proceed with the transfer.

  45. Message 045 From victim Victim Date

    Once the payment is received, what are the next steps?

  46. Message 046 From fog Actor / other Date

    I will give you the decrypter after I see the money in the wallet

  47. Message 047 From fog Actor / other Date

    and instructions of course

  48. Message 048 From victim Victim Date

    We are gathering the payment in the exchange, but we need to proceed gradually with the euro money transfers to the wallet. I believe we can have it ready in less than 48 hours. Maybe in 24 hours. I'll keep you informed.

  49. Message 049 From victim Victim Date

    From the moment we make the payment transfer, how long will it take you to send me the decryptors for Windows files and virtual machines? Will you send them here, or should I give you an email?

  50. Message 050 From fog Actor / other Date

    I will send the decrypters via this chat after full sum received

  51. Message 051 From victim Victim Date

    Hi, I already have the funds available. I'm going to make a small test transfer from this wallet, and then the rest will be ok?

  52. Message 052 From fog Actor / other Date

    Sure. But you have already sent a test amount of 0.000082 BTC. Anyway, you can send another one.

  53. Message 053 From victim Victim Date

    Please give me 3 hours and we will proceed. I write to you here. Thank you.

  54. Message 054 From fog Actor / other Date

    Standing by.

  55. Message 055 From victim Victim Date

    Hi, we just did the test transfer. Please tell me everything is ok.

  56. Message 056 From victim Victim Date

    When you verify it we make the final large transfer.

  57. Message 057 From fog Actor / other Date

    I see 0.003 confirming

  58. Message 058 From victim Victim Date

    ok Sr.

  59. Message 059 From victim Victim Date

    We proceed to make the payment. Can you confirm that I will have the decrypters instantly please?

  60. Message 060 From victim Victim Date

    You're online?

  61. Message 061 From fog Actor / other Date

    I can confirm

  62. Message 062 From victim Victim Date

    ok, thanks. wait a minute please

  63. Message 063 From fog Actor / other Date

    ok

  64. Message 064 From victim Victim Date

    we are working on it, give me just 2 minutes. please prepare the decrypters to send me.

  65. Message 065 From fog Actor / other Date

    preparing

  66. Message 066 From victim Victim Date

    it's OK.

  67. Message 067 From victim Victim Date

    Transfer OK.

  68. Message 068 From victim Victim Date

    It has arrived, can you confirm it for me?

  69. Message 069 From fog Actor / other Date

    confirming

  70. Message 070 From victim Victim Date

    Thanks!

  71. Message 071 From fog Actor / other Date

    give me a minute

  72. Message 072 From victim Victim Date

    ok, sr.

  73. Message 073 From fog Actor / other Date

    Esxi

    chmod +x unlocker./unlocker --id [redacted] --log --target "/vmfs/volumes/"

    Windows unlocker.exe -nomutex -console -target \\SERVER\C$ unlocker.exe -nomutex -console -target C:\

  74. Message 074 From fog Actor / other Date

    [provides a zip file with the decryptor]

  75. Message 075 From victim Victim Date

    OK, we'll try it out and I'll write to you if there are any questions or problems. Thanks.

  76. Message 076 From fog Actor / other Date

    ok I am here

  77. Message 077 From victim Victim Date

    [provides a PNG file] It gives us an error with the ESXI, I attach an image

  78. Message 078 From victim Victim Date

    maybe too many files on the machine?

  79. Message 079 From fog Actor / other Date

    specify one vm in directory of decrypter

  80. Message 080 From victim Victim Date

    we are having some problems. I leave you screenshots:[provides 2 PNG files]

  81. Message 081 From victim Victim Date

    I am attaching the files that we cannot decrypt. Let's see if you can help us since they are very important to be able to operate:[provides 3 TXT files]

  82. Message 082 From victim Victim Date

    We have carried out the test of specifying a machine instead of a folder and it does not give an error, but it does not decrypt either.

  83. Message 083 From victim Victim Date

    It is a very serious problem for us. Please, help.

  84. Message 084 From victim Victim Date

    For example, these files are impossible to decrypt (and they are small):[provides 8.FOG files]

  85. Message 085 From fog Actor / other Date

    my team is working on it

  86. Message 086 From fog Actor / other Date

    how many vms did you already fix and run?

  87. Message 087 From victim Victim Date

    We are very concerned because those machines are the SAP and two other environments we use to operate the business. Without these environments, we cannot function. Let me tell you which machines they are:

  88. Message 088 From victim Victim Date

    1 - [redacted]-flat.vmdk 1 - [redacted].vmdk 0 - [redacted]-flat.vmdk 0 - [redacted]-flat.vmdk [redacted]-flat.vmdk [redacted]-flat.vmdk 0 - [redacted]-flat.vmdk 0 - [redacted].vmdk [redacted]-flat.vmdk [redacted]-ctk.vmdk

  89. Message 089 From victim Victim Date

    And swap files:

    vmx-[redacted].vswp vmx-0 - [redacted].vswp vmx-[redacted].vswp vmx-[redacted].vswp [redacted].vswp

  90. Message 090 From victim Victim Date

    And.vmsd file:

    0 - [redacted].vmsd

  91. Message 091 From victim Victim Date

    And also many other files in.log format that are secondary and not needed to start the machines.

  92. Message 092 From victim Victim Date

    How can we solve this? Do you need me to share more files that we cannot decrypt?

  93. Message 093 From victim Victim Date

    I have shared some small files above that cannot be decrypted.

  94. Message 094 From victim Victim Date

    All the files we cannot decrypt are these (I already listed them above, but here they are again for your reference):

  95. Message 095 From victim Victim Date

    This is very urgent because we cannot operate the business without it. We have tried everything possible. We have tried decrypting locally, on other machines, specifying directory paths, and the final paths of the machines.

  96. Message 096 From fog Actor / other Date

    there are some options for solving this

  97. Message 097 From fog Actor / other Date

    start decryption of the following folders using --threads 16 /vmfs/volumes/[redacted]/ /vmfs/volumes/[redacted]/ /vmfs/volumes/[redacted]/ /vmfs/volumes/[redacted]/ /vmfs/volumes/[redacted]/

  98. Message 098 From fog Actor / other Date

    when you have 'error open file' try to recheck permissions of a file copying it to another folder because permissions could change. use the command ls -la. Example: -rw-r--r-- 1 root root 8024 Aug Decrypter should be run as host file permissions -rw If host and permission don't match, then change host using 'chown' or change permissions using 'chmod'

  99. Message 099 From fog Actor / other Date

    Or another options is to try replace a file to another folder an run decrypter to decrypt exactly this one file

  100. Message 100 From victim Victim Date

    ok let's try it.

  101. Message 101 From victim Victim Date

    Using -- threads 16 and other parameters that we have tried does not work, I attach an image:[provides a PNG file]

  102. Message 102 From victim Victim Date

    Let's test the permissions issue of the second option. However, we run it as root.

  103. Message 103 From victim Victim Date

    We tried the third option yesterday and this morning and it doesn't work for us.

  104. Message 104 From victim Victim Date

    Now I'll tell you about the issue of permissions.

  105. Message 105 From victim Victim Date

    None of the options work.

  106. Message 106 From victim Victim Date

    Without these files we cannot operate, they are the core of the organization.

  107. Message 107 From victim Victim Date

    Do you want me to upload virtual machines to the cloud, or give you access to a system?

  108. Message 108 From victim Victim Date

    please help

  109. Message 109 From fog Actor / other Date

    my team is working on the trouble

  110. Message 110 From fog Actor / other Date

    Upload to the cloud we will fix the file

  111. Message 111 From victim Victim Date

    OK sr. Thanks!!!![provides a.vswp.fog file]

  112. Message 112 From victim Victim Date

    I'm sending you this small file so that your team can analyze why the decrypter doesn't decrypt. We followed all your instructions. Let's see if you can try it in your environment. It's 83Mb of file so you don't have to pass anything bigger that is difficult to handle.

  113. Message 113 From victim Victim Date

    [provides a JPG file] In this image more information with the permissions:[provides another JPG file]

  114. Message 114 From fog Actor / other Date

    ok

  115. Message 115 From fog Actor / other Date

    wait

  116. Message 116 From victim Victim Date

    Thanks!!!!

  117. Message 117 From fog Actor / other Date

    I will have news for you most likely on Sunday

  118. Message 118 From victim Victim Date

    OK, thank you very much for your attention. We will be waiting for your news.

  119. Message 119 From fog Actor / other Date

    send me vmdk or vmdk-flat file

  120. Message 120 From victim Victim Date

    In a few hours you will have the files in a repository. Does that seem okay to you? This way we will not be able to share so many gigabytes. Thank you very much, without these virtual machines our entire company cannot work. It is the core of the business.

  121. Message 121 From victim Victim Date

    Thank you very much

  122. Message 122 From victim Victim Date

    We almost have a machine uploaded to the cloud to share the link with you. We have uploaded a "small" 1.2Gb file of those that also cause problems and are on critical routes for us:

  123. Message 123 From victim Victim Date

    https://[redacted].log.fog

  124. Message 124 From victim Victim Date

    Give me a few minutes and I'll send you the link for the vdmk machine

  125. Message 125 From victim Victim Date

    Thank you for your help. Without these operational vdmk machines our company would go bankrupt.

  126. Message 126 From victim Victim Date

    We have the vdmk uploaded to the cloud. I am sending you credentials:

  127. Message 127 From victim Victim Date

    sftp://[redacted].vmdk.fog

  128. Message 128 From victim Victim Date

    Password: [redacted]

  129. Message 129 From victim Victim Date

    We are waiting for your news. With these files and the 83Mb one I sent you earlier that is also causing problems, I think your programmers could see what is wrong with the decrypter.

  130. Message 130 From victim Victim Date

    We are very concerned because all the critical files of vmdk virtual machines are in this situation. (8 machines)

  131. Message 131 From fog Actor / other Date

    got it

  132. Message 132 From fog Actor / other Date

    I wait for something from my team

  133. Message 133 From victim Victim Date

    Thanks

  134. Message 134 From victim Victim Date

    Hi, sorry to bother you. I wanted to know if we'll receive any updates today on how to resolve the file decryption issues. We are overwhelmed as we cannot decrypt files like the ones I mentioned in the conversation. Thank you, sorry for the insistence.

  135. Message 135 From victim Victim Date

    Please, if you don't help us, our company will close, and we will lose our jobs.

  136. Message 136 From fog Actor / other Date

    we will help

  137. Message 137 From fog Actor / other Date

    wait

  138. Message 138 From victim Victim Date

    Thanks!!!!

  139. Message 139 From victim Victim Date

    Can we turn off the SFTP machine where we have uploaded the.vmdk file?

  140. Message 140 From victim Victim Date

    We can leave it active if necessary.

  141. Message 141 From fog Actor / other Date

    let it be active for some time

  142. Message 142 From victim Victim Date

    Ok thanks

  143. Message 143 From fog Actor / other Date

    try to copy a vmdk file to a separate folder and run it after removing extension.fog

  144. Message 144 From victim Victim Date

    OK,wait a moment.