extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Hive — 20211102

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 58 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Hive
Record date
Nov 02, 2021
Messages
58
Participants
Hive, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Hive Actor / other Date

    Hello and welcome to Hive. How may I help you?

  2. Message 002 From Hive Actor / other Date

    Hello! Waiting for your decision, otherwise I will be forced to raise the price if ignored and put your information on my information auction.

  3. Message 003 From Victim Victim Date

    Anyone still here?

  4. Message 004 From Hive Actor / other Date

    hi

  5. Message 005 From Hive Actor / other Date

    How may I help you?

  6. Message 006 From Victim Victim Date

    What's your intention here?

  7. Message 007 From Hive Actor / other Date

    We don't care about your company files, we don't care about that, we're only interested in profit. This is business. Are you ready to make a deal?

  8. Message 008 From Hive Actor / other Date

    Decrypting your server and removing stolen confidential files from your servers costs you $200,000 in bitcoins.

  9. Message 009 From Victim Victim Date

    Wow...$200,000 in bitcoins is serious money. No idea who you are or what data you're talking about.

  10. Message 010 From Hive Actor / other Date

    After payment, you will receive:

    1) Transcription software 2) Promise of non-disclosure 3) Access to storage of decrypted files 4) Security report

    To convince you to pay, we can make calls to your customers to notify them of the incident.

  11. Message 011 From Victim Victim Date

    Trust me, that's the last thing I need. Just trying to get details from you. Just feeling very targeted right now.

  12. Message 012 From Victim Victim Date

    How do I know you have files?

  13. Message 013 From Hive Actor / other Date

    If you are willing to cooperate, I will give you some files to confirm, but it does not matter, as it is silly to think that we have not downloaded anything when big money is being decided. You can read public news and our publications to be sure of our words http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

  14. Message 014 From Hive Actor / other Date

    lacveeam1.lac.[redacted].com MDVTSQL1 lacsql2012.lac.[redacted].com SQLCLUSTER02 lacwsus.lac.[redacted].com CIFSFTPDATA What files from these hosts are you interested in? Maybe you are interested in other hosts, tell me the name of the host

  15. Message 015 From Victim Victim Date

    Which hosts did you take files from?

  16. Message 016 From Hive Actor / other Date

    I don't know which hosts your data was downloaded from. We took only those files that were of interest and could be sold to third parties. Typically, customer data, databases, financial reports, corporate email archives and other classified and confidential data related to the company's activities (technological developments, blueprints, drug clinical trials, software codes, etc.) are downloaded.

  17. Message 017 From Victim Victim Date

    Can you show us what the files of interest were?

  18. Message 018 From Hive Actor / other Date

    We selected several random files from the downloaded repository and attached to the panel. You can watch it.

  19. Message 019 From Victim Victim Date

    Can you decrypt these 2 files?

  20. Message 020 From Hive Actor / other Date

    I have decrypted both files

  21. Message 021 From Victim Victim Date

    Are these all the files you took from me?

  22. Message 022 From Victim Victim Date

    Can you give me a list of all the files you have?

  23. Message 023 From Victim Victim Date

    Are you here?

  24. Message 024 From Hive Actor / other Date

    hi

  25. Message 025 From Hive Actor / other Date

    We have uploaded a list of all your files that we have. You can see them in the panel.

  26. Message 026 From Victim Victim Date

    Thanks, we'll take a look today. So basically if we don't pay, everything in this list gets onto your site?

  27. Message 027 From Hive Actor / other Date

    Yes, the files will be revealed here on the site. We will also study them in more detail and post them on other forums. You should understand that this information can get to intruders.

  28. Message 028 From Victim Victim Date

    Understood. We are uploading the files with the key file now.

  29. Message 029 From Hive Actor / other Date

    ok

  30. Message 030 From Hive Actor / other Date

    These both files contain sensitive info. I will not disclose them to you before payment. Choose another files or I can upload them to you truncated

  31. Message 031 From Victim Victim Date

    We have hundreds of files like this that need to be unlocked. These two alone won't make a difference. We just want to make sure your tool works since there's little value in paying if we can't get these files fixed.

  32. Message 032 From Hive Actor / other Date

    We are well-known organization and our decryptor works. Otherwise you would able to read about any issues with other companies which are hundreds.

  33. Message 033 From Victim Victim Date

    We've seen it work on the first 2 files you fixed but we've heard that encryption can sometimes corrupt files too. The last thing we want to do is pay and not get our files back. We can't afford to pay a dime without knowing that your tool will get us back up and running. Sorry if this isn't a normal ask. We're just against a wall right now and this would really help.

  34. Message 034 From Hive Actor / other Date

    Upload any other files and a corresponding key(s) without any important info in them.

  35. Message 035 From Victim Victim Date

    We're just worried about this particular file type. That's the main issue.

  36. Message 036 From Hive Actor / other Date

    I already decrypt these two last files you uploaded, but I can't send you them to you due to sensitive info inside

  37. Message 037 From Hive Actor / other Date

    So you will be able to do the same right after you'll purchase the decryption software

  38. Message 038 From Victim Victim Date

    Not sure how we'll be able to pay without seeing it. I've read a lot online and people are always running into issues with decryption. This is going to be a risk no matter what, but we need certain assurances

  39. Message 039 From Victim Victim Date

    If you can't send the files, can you send a screenshot?

  40. Message 040 From Hive Actor / other Date

    We will answer you a little bit later.

  41. Message 041 From Hive Actor / other Date

    I have uploaded shorten files

  42. Message 042 From Victim Victim Date

    We'll review them. If they look good, then we can pay $100,000. That's a little more cash than what we actually have, but we'll take a step towards you to make this happen. Do we have an agreement?

  43. Message 043 From Hive Actor / other Date

    The price is not a subject to discuss.

  44. Message 044 From Victim Victim Date

    This isn't about a low ball. No idea how to get our hands on $200,000. What's something reasonable you'd consider?

  45. Message 045 From Hive Actor / other Date

    The price of $ 200,000 was announced at the very beginning of the negotiations. After that, you continued negotiations, specifying all the necessary information for you. thereby you agreed to the announced amount. You didn't just waste your time on this, did you? Your company look can afford this amount and you know it. We did not overstate the cost, the price is optimal for you. I ask you to make a decision and make a payment as soon as possible. Then we will fulfill all the stated conditions immediately.

  46. Message 046 From Victim Victim Date

    We were trying to see if this was a viable solution before discussing the financial side. It wouldn't make sense for us to go through with this if we weren't sure on what we were getting from you. We're a small business and we figured you wouldn't accept a small price. $100,000 is not a small price.

  47. Message 047 From Victim Victim Date

    If we can move some money around and increase what we can send you to $150,000 will you accept? This is a lot of money for us, we're just a small business and we're trying to take a step in reaching a quick agreement with you.

  48. Message 048 From Hive Actor / other Date

    I fully understand you. I understand what a difficult situation you are in. And for this reason, I will help you, I agree to $ 170,000. I will ask you to also help me and make the payment quickly.

  49. Message 049 From Victim Victim Date

    Ok, it's late right now but I will bring this to my team first thing in the morning. Thank you

  50. Message 050 From Victim Victim Date

    Is the wallet [redacted]? Also, what will we get from you if we pay $170,000?

  51. Message 051 From Hive Actor / other Date

    After payment you will get:

    1) The decryption software 2) Promise of non-disclosure 3) Access to exfiltrated files storage 4) Security report

  52. Message 052 From Hive Actor / other Date

    Yes, our wallet [redacted]

  53. Message 053 From Victim Victim Date

    Paid. Can we get the tool now?

  54. Message 054 From Hive Actor / other Date

    Wait a little bit. We'll get to step 1 soon.

  55. Message 055 From Victim Victim Date

    and steps 2-4?

  56. Message 056 From Hive Actor / other Date

    3) Access to exfiltrated files storage mega.nz login megashara@onionmail.org Password [redacted]

  57. Message 057 From Hive Actor / other Date

    4) Security report https://dropmefiles.net/en/[redacted]

  58. Message 058 From Victim Victim Date

    checking this out