extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

fog — 20240927

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 60 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
fog
Record date
Sep 27, 2024
Messages
60
Participants
fog, victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From victim Victim Date

    Hello, we found several of our systems encrypted with your ransomware. Can we talk about resolving this?

  2. Message 002 From fog Actor / other Date

    hi

  3. Message 003 From fog Actor / other Date

    I will give you details soon and we will talk

  4. Message 004 From fog Actor / other Date

    [provides a compressed RAR files list] this is what's been taken

  5. Message 005 From victim Victim Date

    We will need some time to take a look at this. In the mean time how would we get our systems decrypted?

  6. Message 006 From fog Actor / other Date

    when you pay you receive decrypter to fix your systems

  7. Message 007 From fog Actor / other Date

    I will tell you the price for decrypter soon

  8. Message 008 From victim Victim Date

    How much would the decrypter cost? Can you confirm that our files would be deleted from your servers and that you will not publish our name or share the data?

  9. Message 009 From fog Actor / other Date

    yes I can confirm your files will be deleted and your name will not be published

  10. Message 010 From fog Actor / other Date

    I will tell you price soon

  11. Message 011 From fog Actor / other Date

    If you want your data fully decrypted and the files we stole removed from our source, you will have to pay a fee. We will also be able to provide a security report and explain how we did it to get in. The bosses are demanding $800,000 for said services.

  12. Message 012 From fog Actor / other Date

    Do we work?

  13. Message 013 From victim Victim Date

    $800,000 is too high. We are looking to reach an agreement and can offer $150,000 to get this finished quickly.

  14. Message 014 From fog Actor / other Date

    There's no way we're going to agree to that amount. I don't think we can even give you a $150,000 discount. our demand is more than reasonable in your case. I will talk to the bosses

  15. Message 015 From fog Actor / other Date

    bosses agreed to take 715k for everything

  16. Message 016 From victim Victim Date

    How do we know the decrypter will work? Could you decrypt some files for us so we can be sure this will work on our systems

  17. Message 017 From fog Actor / other Date

    yes

  18. Message 018 From fog Actor / other Date

    give me a few

  19. Message 019 From victim Victim Date

    [provides a zip archive of files to decrypt] there are a few small encrypted files in here

  20. Message 020 From fog Actor / other Date

    give me some time

  21. Message 021 From fog Actor / other Date

    [provides 5 decrypted files]

  22. Message 022 From victim Victim Date

    Thank you. Our business isn't doing as well as we used to and we don't have insurance to cover this. We can't afford anywhere near that amount. We would still like to resolve this, but it needs to be close to our previous offer

  23. Message 023 From fog Actor / other Date

    I cant close the case at your previous offer

  24. Message 024 From fog Actor / other Date

    you need to add something to your offer

  25. Message 025 From victim Victim Date

    Cash is really tight for us, we are doing all we can but can only raise our offer to $175,000.

  26. Message 026 From fog Actor / other Date

    I talked to the bosses. $500,000 and we can end this today. I don't think that you will get any better deal

  27. Message 027 From victim Victim Date

    We simply cannot afford that. We have rebuilt most of our systems without the decrypter. Can we agree at $200,000 today?

  28. Message 028 From fog Actor / other Date

    bosses agree to take 350k today

  29. Message 029 From fog Actor / other Date

    this is the best bet price for the situation

  30. Message 030 From fog Actor / other Date

    tell me when ready to make payment

  31. Message 031 From fog Actor / other Date

    just take one last step, and we'll put this behind us.

  32. Message 032 From fog Actor / other Date

    bosses can take one last step and decrease to 300k. the wallet is [redacted]

  33. Message 033 From fog Actor / other Date

    hi

  34. Message 034 From fog Actor / other Date

    are you leaving me?

  35. Message 035 From fog Actor / other Date

    tell me should I wait the money today or what

  36. Message 036 From fog Actor / other Date

    I need your decision guys.

  37. Message 037 From fog Actor / other Date

    this week we have to close your case

  38. Message 038 From victim Victim Date

    We can't go that high, we can offer $225,000

  39. Message 039 From fog Actor / other Date

    I can't take 225k

  40. Message 040 From fog Actor / other Date

    confirm 250k to me and I will make my bosses take the offer 250k

  41. Message 041 From fog Actor / other Date

    we can do that today only

  42. Message 042 From fog Actor / other Date

    hello. what is your decision?

  43. Message 043 From victim Victim Date

    ok we will pay $250,0000, can you confirm you will provide a decrypter and you will delete all our data? We will need some time to arrange the payment

  44. Message 044 From fog Actor / other Date

    I can confirm that you will receive the.exe files that you will need to run on your systems (win or esxi) to decrypt your files. We guarantee that you will be able to recover all the encrypted data. We will give you a deletion log file which means the files we stole.were removed from our source.

  45. Message 045 From fog Actor / other Date

    Please let me know when the money has been sent

  46. Message 046 From fog Actor / other Date

    hi

  47. Message 047 From fog Actor / other Date

    can you tell me when are you going to make payment?

  48. Message 048 From victim Victim Date

    we are sending a small amount to check it works ok. Can you confirm when you receive it?

  49. Message 049 From fog Actor / other Date

    yes send please

  50. Message 050 From fog Actor / other Date

    I received 0.0001 btc. you can send the full amount now

  51. Message 051 From victim Victim Date

    we are arranging the bitcoin for the full amount and will let you know when we are making the payment

  52. Message 052 From fog Actor / other Date

    waiting, thanks

  53. Message 053 From victim Victim Date

    we've sent the payment

  54. Message 054 From fog Actor / other Date

    [provides the decryptor in a 7zip compressed file] Windows unlocker.exe -nomutex -console -target \\SERVER\C$ unlocker.exe -nomutex -console -target C:\

    Esxi \ LINUX chmod +x unlocker_key./unlocker_key --id [redacted] --log --target "/vmfs/volumes/"

  55. Message 055 From victim Victim Date

    Hi, we are working through recovering our systems but we cannot access our domain controller as you have changed the administrator password. Please could you tell us what the password for the domain administrator account was changed to?

  56. Message 056 From fog Actor / other Date

    all domain admins passwords "gotochatplease"

  57. Message 057 From victim Victim Date

    Can you still provide us a report on how you got access into our network? Also can you confirm you have deleted all our data now?

  58. Message 058 From fog Actor / other Date

    I will tell you soon

  59. Message 059 From victim Victim Date

    Do you have any update please?

  60. Message 060 From fog Actor / other Date

    You data has been deleted. Access to your network was gained through a phishing mail. Your staff should be more vigilant when downloading and opening unfamiliar files. We recommend that you implement the following measures to protect your corporate network: 1) Enforce passwords on local and domain admins. Complicate group policy on passwords for all users; 2) Using the group "Protected users"; 3) Use centralised management of antivirus protection; 4) Inform users not to open suspicious emails and files; 5) Updating software and OS to current versions; 6) Set up permission delegations in the Active Directory; 7) Install an application to monitor activity in the Active Directory; 8) Use Vmware Esxi ver. 7.0 or more current. Our team guarantees that any data taken from your network will not be disclosed, sold or published. Of course, this dialogue will also remain confidential.