Nightspire — 20250418
Dated recordFrom extortion.wiki, the ransomware negotiation research archive
A validated static rendering of 38 messages in source-array order. Transcript text is preserved without editorial additions.
- Actor
- Nightspire
- Record date
- Apr 18, 2025
- Messages
- 38
- Participants
- Nightspire, Victim
Preserved messages
Actor / other Victim
Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.
-
Message 001 From Victim Victim Date Hello. We received your note. Are you available to discuss recovery options?
-
Message 002 From Nightspire Actor / other Date Not recorded Hi. Yes, online 24/7. Price for full decryptor, master key + data deletion guarantee: 1 BTC.
-
Message 003 From Nightspire Actor / other Date Not recorded We already exfiltrated 120 GB of your sensitive data. Payment within 5 days or publish starts.
-
Message 004 From Victim Victim Date Not recorded 1 BTC is impossible for us. We're a small-size manufacturing company. What's your realistic lowest offer?
-
Message 005 From Nightspire Actor / other Date Not recorded We know your revenue from leaked docs — last year ~$1M. 1 BTC is only 10% — very fair.
-
Message 006 From Nightspire Actor / other Date Not recorded But ok, show seriousness. Best we can do now: 0.8 BTC if paid in 72 hours.After that price increases 20% every 48 hours.
-
Message 007 From Victim Victim Date Not recorded Still way too high. We consulted internally — board approved max budget 0.1 BTC for this incident.
-
Message 008 From Victim Victim Date Not recorded We can pay that quickly if you prove decryption works. Can you decrypt 5 sample files first?
-
Message 009 From Nightspire Actor / other Date Not recorded 0.1? Too low, we reject. But we accept test decryption to build trust.Send up to 5 files (max 10MB each, different types/folders). After we return them decrypted, we talk serious discount.
-
Message 010 From Victim Victim Date Not recorded Ok, uploading now:1. [redacted].nspire2. [redacted].nspire3. [redacted].nspire4. [redacted].nspire5. [redacted]_2024.nspire
-
Message 011 From Nightspire Actor / other Date Not recorded Wait a mins.
-
Message 012 From Nightspire Actor / other Date Not recorded https://gofile.io/[redacted]
-
Message 013 From Nightspire Actor / other Date Not recorded Here are your 5 decrypted files. All perfect, no corruption.Now, with proof given — special price for fast deal: 0.75 BTC.Pay in 48 hours, we stop leak timer and send tool immediately after confirm.
-
Message 014 From Victim Victim Date Not recorded Thank you for the test — files open fine.But that amount is still double what we can realistically do.We can counter at 0.2BTC. That's our absolute max, including recovery costs.
-
Message 015 From Victim Victim Date Not recorded If you accept, we start BTC purchase today.
-
Message 016 From Nightspire Actor / other Date Not recorded 0.2? No, that's insulting after seeing your revenue docs.We can meet you at 0.7 BTC. Final offer for today only.We have buyers interested in your data already — automotive industry competitors.
-
Message 017 From Victim Victim Date Not recorded We understand pressure, but bankruptcy isn't an option.How about 0.3? We can wire equivalent BTC within 24-36 hours.Also, can you provide more proof? Maybe decrypt one more critical file from a different server?
-
Message 018 From Nightspire Actor / other Date Not recorded Ok, send one more file for second proof. Max 10MB.
-
Message 019 From Nightspire Actor / other Date Not recorded After that — if you pay 0.6 BTC in 24 hours we close deal.No more haggling after this.
-
Message 020 From Victim Victim Date Not recorded Uploading one more: [redacted].nspir
-
Message 021 From Nightspire Actor / other Date Not recorded Got it. Decrypting... Returned decrypted.Everything checks out. Final price locked: 0.6 BTC.
-
Message 022 From Nightspire Actor / other Date Not recorded Wallet: bc1[redacted]You have 24 hours.
-
Message 023 From Victim Victim Date Not recorded We pushed board hard — they approved up to 0.5 BTC max.We pay immediately (within 12 hours).
-
Message 024 From Nightspire Actor / other Date Not recorded Ok, 0.5 BTC accepted. You must pay in 12 hours. After that price increases 20% everyday.Send BTC to above wallet.Notify tx id here when sent.
-
Message 025 From Victim Victim Date Not recorded Agreed on 0.5 BTC. Converting funds now.Will take ~8-10 hours for full amount.Please confirm timer paused.
-
Message 026 From Nightspire Actor / other Date Not recorded Timer paused during negotiation/payment window. But if no tx by 12 hours total — resumes.Keep us updated.
-
Message 027 From Victim Victim Date Not recorded Tx initiated. Hash: https://mempool.space/tx/[redacted]
-
Message 028 From Victim Victim Date Not recorded Should confirm soon.
-
Message 029 From Nightspire Actor / other Date Not recorded Good. https://gofile.io/[redacted]
-
Message 030 From Nightspire Actor / other Date Not recorded You can find help.txt on our 7z file.
-
Message 031 From Victim Victim Date Not recorded Downloaded and tested on test VM — decrypts sample perfectly.Starting on production servers now. Will update progress.
-
Message 032 From Nightspire Actor / other Date Not recorded Good. We monitor chat for next 72 hours if needed.After full recovery confirmed by you — we permanently delete all data.
-
Message 033 From Victim Victim Date Not recorded Decryption complete.
-
Message 034 From Victim Victim Date Not recorded All critical systems back online. Thank you for the support.
-
Message 035 From Nightspire Actor / other Date Not recorded Excellent. Data deletion has been completed on our side.
-
Message 036 From Nightspire Actor / other Date Not recorded Logs wiped, no backups kept.
-
Message 037 From Victim Victim Date Not recorded Understood. Closing this channel.
-
Message 038 From Victim Victim Date Not recorded Thanks again.