extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

REvil — 20210630

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 42 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
REvil
Record date
Jun 30, 2021
Messages
42
Participants
REvil, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From REvil Actor / other Date

    hi

  2. Message 002 From Victim Victim Date

    Hi, are you able to help us understand what happened?

  3. Message 003 From REvil Actor / other Date

    Hello, you network encrypted and data was stolen

  4. Message 004 From Victim Victim Date

    ok, we understand. Will you please tell us how you got into our network?

  5. Message 005 From REvil Actor / other Date

    We will tell only after payment

  6. Message 006 From Victim Victim Date

    Hi, you said our data was stolen. What do you mean? How much was taken? Thank you.

  7. Message 007 From REvil Actor / other Date

    near 140Gb of data

  8. Message 008 From REvil Actor / other Date

    You can check in your logs, we upload data in our cloud and transfer data to our servers.

  9. Message 009 From Victim Victim Date

    thanks for the information. Would you please provide a sample of the data? We need to review this and show our management. Thank you

  10. Message 010 From REvil Actor / other Date

    wait for answer

  11. Message 011 From REvil Actor / other Date

    examples

  12. Message 012 From Victim Victim Date

    Thanks for the files. Management is reviewing them. Our team needs to understand how the decryption software works. Does the same decryptor work on every machine?

  13. Message 013 From REvil Actor / other Date

    One decoder, you can decode all machines

  14. Message 014 From Victim Victim Date

    Thanks! The machines have different encrypted file extensions. How does that work for the decryptor tool? Do you need all of the extensions? Please explain how that works.

  15. Message 015 From REvil Actor / other Date

    we send universal decryptor and all instruction

  16. Message 016 From Victim Victim Date

    You do not need extensions from us?

  17. Message 017 From REvil Actor / other Date

    no, you will get universal decryptor for all extension

  18. Message 018 From Victim Victim Date

    Thanks for the information. We are working with you to try to understand the process. We have a lot to review given this situation. It is now the weekend. Would you please add more time to the clock? Thank you for your help.

  19. Message 019 From REvil Actor / other Date

    of course

  20. Message 020 From REvil Actor / other Date

    update

  21. Message 021 From Victim Victim Date

    Hi, our team has questions about the trial decryption. Does the file we upload need a certain extension? Can it come from any machine? thanks

  22. Message 022 From REvil Actor / other Date

    Hello you can send test file to this chat

  23. Message 023 From Victim Victim Date

    Thank you. We will locate a few files to test. Also, the current price is much too high for us to pay. As you can see in the files you took, we have many financial problems including a recent bankruptcy, and we do not have insurance. Please help us with a lower price.

  24. Message 024 From REvil Actor / other Date

    My boss can offer 20% discount if your pay fast

  25. Message 025 From Victim Victim Date

    Thank you for the discount. We want to work with you but this is still much too expensive. Will your boss please give us a larger discount since we have all of those financial problems? Thanks

  26. Message 026 From REvil Actor / other Date

    We know your financial problems, but we also know how much you earn. 20% is all we have to offer

  27. Message 027 From Victim Victim Date

    Ok, would you please give us more time on the clock so we can try to reach an agreement with you. This is a difficult situation for our team and we are in good faith trying to reach a resolution. Thank you

  28. Message 028 From REvil Actor / other Date

    2 days added

  29. Message 029 From Victim Victim Date

    Hi, thanks for the extra time. Would you please decrypt this png file. Thanks

  30. Message 030 From REvil Actor / other Date

    file

  31. Message 031 From Victim Victim Date

    Thanks for the decryption test. Please understand we are not in the financial position to pay this high price. Will you please ask your boss again what he can do to help us?

  32. Message 032 From REvil Actor / other Date

    20% discount if you pay fast

  33. Message 033 From REvil Actor / other Date

    so - time ending. What we should do?

  34. Message 034 From Victim Victim Date

    The price with only a 20% discount is still $2million USD. This is much too high for us to afford. We do not have insurance. Are you able to give us a higher discount? Thanks!

  35. Message 035 From REvil Actor / other Date

    Make an interesting offer and my boss will consider it.

  36. Message 036 From Victim Victim Date

    Hi, we talked to our management and they asked a couple questions today. Do we get all of our data back before you delete it? Will you tell us exactly when and how you got into our network? Please let us know..

  37. Message 037 From REvil Actor / other Date

    Everything can be restored in a few hours. You will also receive a complete list of files.

  38. Message 038 From REvil Actor / other Date

    Yes, we can help you secure your network

  39. Message 039 From Victim Victim Date

    Hi. Our management is still evaluating the situation and the costs. If we can come to a reasonable agreement, would it be possible to pay in bitcoin? Our understanding is that XMR is more difficult for us to get. We have to keep our costs down.

  40. Message 040 From Victim Victim Date

    Hi. Our management is still evaluating the situation and the costs. If we can come to a reasonable agreement, would it be possible to pay in bitcoin? Our understanding is that XMR is more difficult for us to get. We have to keep our costs down.

  41. Message 041 From REvil Actor / other Date

    Of course

  42. Message 042 From REvil Actor / other Date

    hi, Tomorrow we upload your data to auction.and after sale start spam attack to your partner with your data