Akira — 20231209 — extortion.wiki

Actor: Akira
Record date: Dec 09, 2023
Messages: 112
Participants: Akira, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

Message 001 From Victim Victim Date Not recorded

> Hello, our servers have been locked down and we would kindly ask that you unlock us. We're a small family business and rely on our computers. Thank you.
Message 002 From Victim Victim Date Not recorded

> Hello
Message 003 From Akira Actor / other Date Not recorded

> Hello. You've reached an Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. We will reach out to you soon.
Do you have a permission to conduct a negotiation on behalf of your organization? Once we get a response you will be provided with all the details.
Message 004 From Victim Victim Date Not recorded

> Can you tell us what do you expect for unlocking us? We need our servers back. Thank you.
Message 005 From Victim Victim Date Not recorded

> yes I have
Message 006 From Akira Actor / other Date Not recorded

> [redacted]_lisling.txt // 2.22 MB
Message 007 From Akira Actor / other Date Not recorded

> These files were taken from your network prior to encryption. You can pick 2-3 random files from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files to our chat and we will upload decrypted copies back.
We're looking through your financial papers to come up with a reasonable demand to you. We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.
Let me know whether you're interested in a whole deal or in parts. This will affect the final price.
Message 008 From Victim Victim Date Not recorded

> We're interested to see the pricing 1,2,3,4,5 to understand.
Message 009 From Victim Victim Date Not recorded

> So whole deal
Message 010 From Victim Victim Date Not recorded

> Hello, can we get offer?
Message 011 From Akira Actor / other Date Not recorded

> Sure. Wait a bit.
Message 012 From Akira Actor / other Date Not recorded

> The full package will cost you $180,000 where the full decryption assistance is $100,000, the evidence of data removal is $70,000 and the report is $10,000. All the guarantees are coming as a default.
Message 013 From Victim Victim Date Not recorded

> We beg for lower price. This is huge amount for our company. Can we please get price of several 10k? This is really huge. I beg you on behalf of myself, my family and our employees.
Message 014 From Victim Victim Date Not recorded

> Please
Message 015 From Akira Actor / other Date Not recorded

> Are you interested in the full package, right? If you're able to arrange payment within next 2-3 days, we will consider a discount but it won't be more than 20%.
Message 016 From Victim Victim Date Not recorded

> We could pay in 2-3 days 40.000 USD for decryption and I would ask that you do not attack us again and remove data.
Message 017 From Akira Actor / other Date Not recorded

> $140,000 and you will receive all of our services.
Message 018 From Victim Victim Date Not recorded

> I ask you to support us. We are people as you are.
Message 019 From Victim Victim Date Not recorded

> We are not corporation
Message 020 From Victim Victim Date Not recorded

> This is how much we can give now for decryption, that we can recover data and then we negotiate further.
Message 021 From Akira Actor / other Date Not recorded

> I understand the situation you're in. I don't make decisions here, I'm just a mediator. So, please manage to gather more funds and my bosses will be able to help. We have our internal policy and we can't accept such small amounts. Thank you for understanding.
Message 022 From Victim Victim Date Not recorded

> Plaese
Message 023 From Akira Actor / other Date Not recorded

> Raise your amount up to 6 figures and we will shake hands.
Message 024 From Victim Victim Date Not recorded

> I would kindly ask for your answer on our last request.
Message 025 From Victim Victim Date Not recorded

> 60.000 USD plis
Message 026 From Victim Victim Date Not recorded

> Plis
Message 027 From Akira Actor / other Date Not recorded

> $120,000 and we will shake hands.
Message 028 From Victim Victim Date Not recorded

> We can pay 70k maximum. Please, we are a small business, which has to fight everyday for every penny. For us this is shock. Please spare us. Let's find agreement in this reasonable amount.
Message 029 From Akira Actor / other Date Not recorded

> We highly appreciate your willingness to work with us and see how you value your business but we cannot accept this amount. We've had a meeting as result of which the upper management has decided to take another step towards you and come down to $105,000. Let's just split that difference between you and us and get this over. Once you confirm the sum I will drop off our wallet and we will start preparing all the deliverables.
Message 030 From Victim Victim Date Not recorded

> Hello, we accept 105.000 USD. How do we know we will recieve full package and trust thigs will be settled and we will not be attacked again? Will we recieve full package? How do we pay?
Message 031 From Akira Actor / other Date Not recorded

> That's good. After we receive the transfer we will provide you with the decryption tool and the rest including our guarantees not to attack you again. You will be provided with our BTC wallet id soon.
Message 032 From Akira Actor / other Date Not recorded

> Here is the BTC wallet [redacted] Let me know when can we expect the transfer.
Message 033 From Victim Victim Date Not recorded

> I assume this is Bitcoin payment. We don't have Bitcoint account in our company and I am also not using it personally. I have started the procedure of opening account personnally becuase it is much faster than opening for company. I still need to transfer the money from company to my personal account, then to Bitstamp, then to yoiur wallet. I am now waiting from the bank if they can send me money on my personal account as our payment system is encrypted. Then I hope that Bitstamp will proceed fast and that we settle all this today. How long it will last that we get all above after you recieve payment? Thank you.
Message 034 From Victim Victim Date Not recorded

> We would like to be sure that decryption is working. Please can you send us files /home/[redacted].pdf /home/[redacted].pdf /home/[redacted].pdf
Message 035 From Victim Victim Date Not recorded

> Also we would like to be sure that decryption key is working. You encrypted our virtual environment so we dont have access to files only vmdk files. Can we upload vmdk file?
Message 036 From Akira Actor / other Date Not recorded

> You will receive all the decryptors immediately after payment. Please upload vmdk file. We will provide you with requested files soon as well.
Message 037 From Victim Victim Date Not recorded

> Hello, I am waiting for the money to land on Bitstamp, then I will first transfer 0.01 BTC for you to confirm me that you have recieved. Then the rest (and after test on above files)..
Message 038 From Victim Victim Date Not recorded

> [redacted].vmx.akira // 4.6 KB
Message 039 From Victim Victim Date Not recorded

> [redacted].log.akira // 1.86 MB
Message 040 From Victim Victim Date Not recorded

> vmdk is not possible to upload it's 16 GB
Message 041 From Akira Actor / other Date Not recorded

> We will decrypt the uploaded file. Please wait.
Message 042 From Victim Victim Date Not recorded

> Hello, when can we expect decrypted files?
Message 043 From Victim Victim Date Not recorded

> We have now transferred our funds to Bitstamp, however they have blocked us due to new account and unusualy high amount and the case is opened there, that we will be able to make payment.
Message 044 From Victim Victim Date Not recorded

> [redacted] - Bitstamp.pdf // 44.3 KB
Message 045 From Victim Victim Date Not recorded

> Hello, we would really ask for soonest resolvment. Please.
Message 046 From Akira Actor / other Date Not recorded

> Hello. Please be patient with us. We will provide everything shortly.
Message 047 From Akira Actor / other Date Not recorded

> [redacted].log // 1.86 MB
Message 048 From Akira Actor / other Date Not recorded

> [redacted].vmx // 4.09 KB
Message 049 From Victim Victim Date Not recorded

> Thank you. Files are ok.
Message 050 From Victim Victim Date Not recorded

> I have opened personal account on Bitstamp and put on the account 105.000 USD. I am now in compliance procedure on Bitstamp due to high transaction amount and we are pushing on them to release the security limits, that we can transfer funds. We will inform you immediatelly.
Message 051 From Akira Actor / other Date Not recorded

> How's your progress with payment?
Message 052 From Victim Victim Date Not recorded

> I have opened personal account on Bitstamp and put on the account 105.000 USD. I am now in compliance procedure on Bitstamp due to high transaction amount and we are pushing on them to release the compliance limits, that we can transfer funds. We will inform you immediatelly.
Message 053 From Victim Victim Date Not recorded

> [redacted] - Bitstamp.pdf // 44.3 KB
Message 054 From Victim Victim Date Not recorded

> in pdf printscreen from Bitstamp. I hope they solve this asap, that we send payment.
Message 055 From Akira Actor / other Date Not recorded

> Thank you. Keep us updated please.
Message 056 From Victim Victim Date Not recorded

> I have just got information from some people in slovenian Bitstamp that we can expect answer from compliance department tomorrow.
Message 057 From Akira Actor / other Date Not recorded

> Ok.
Message 058 From Victim Victim Date Not recorded

> Good morning. I still wait for Bitstamp to open my account for buy BTC and transfer it...
Message 059 From Akira Actor / other Date Not recorded

> We are waiting.
Message 060 From Victim Victim Date Not recorded

> Hello, I am unfortunatelly still waiting for Bitstamp to release my trading despite many urgencies. Printscreen in attachement.
Message 061 From Victim Victim Date Not recorded

> Status at Bitstamp.jpg // 85.6 KB
Message 062 From Akira Actor / other Date Not recorded

> You need to assure them that you use your funds in investment purposes.
Message 063 From Victim Victim Date Not recorded

> Hello, we didn't recieve any response from Bitstamp yet and as I understand my Bitstamp account is under red flag as I put in so big amount of money. We are desparate and our business has started to seriously suffer and orders are being canceled as we can't operate:(. Can you please decrypt us? We will pay anyhow. Can you help us how to pay?
Message 064 From Akira Actor / other Date Not recorded

> We can't provide anything before payment. I will learn how we can help.
Message 065 From Akira Actor / other Date Not recorded

> What has Bitstamp support responded?
Message 066 From Akira Actor / other Date Not recorded

> Could you please give us more details?
Message 067 From Victim Victim Date Not recorded

> They have responded only that they are processing and phone support is saying that it is in compliance department and has been escalated to higher level. We have contacted some people from Bitstamp here in Slovenia to help us accelerate the process there. Hope to get answer asap. I have today opened account also on other exchange and I will try to proceed also there (Swissborg) if Bitstamp doesn't work. Can you help me what are other options?
Message 068 From Victim Victim Date Not recorded

> Status Bitstamp [redacted].jpg // 101 KB
Message 069 From Akira Actor / other Date Not recorded

> Please wait.
Message 070 From Akira Actor / other Date Not recorded

> To gain bitcoins you need to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only. Additionally, maybe this title will help: https://www.csoonline.com/article/570047/how-to-buy-bitcoin-for-ransomware-payment-if-you-must.html
Message 071 From Victim Victim Date Not recorded

> Thanks for that info. We have done exactly that with second account on [redacted]. For investment purposes only. I will read your link and I sincerely hope that tomorrow this will be settled.
Message 072 From Akira Actor / other Date Not recorded

> We hope too. Thank you.
Message 073 From Victim Victim Date Not recorded

> Good morning. Just update. Payment went this morning from my bank to Swissborg. I will keep you informed during day on progress.
Message 074 From Akira Actor / other Date Not recorded

> Thank you.
Message 075 From Victim Victim Date Not recorded

> Hello. I am providing latest update. Today at 8:45 AM I have paid money to [redacted] bank account in Malta and now I am still waiting that their system processes the payment and that this payment will be shown in my [redacted] app on the phone. They say that it takes 1 to 3 days. Since I have paid by SEPA payment I assume that the money should be visible in the app if not today, latest on Monday. I have checked in advance compliance procedure on [redacted] and I have all documents for compliance ready, so I don't expect any problems with compliance and I will then buy Bitcoins and transfer them to your wallet. Thank you for patience.
Message 076 From Victim Victim Date Not recorded

> If you need some information for proof of above happening let me know. Bitstamp has stolen us two days.
Message 077 From Akira Actor / other Date Not recorded

> Thank you for update. We're standing by.
Message 078 From Victim Victim Date Not recorded

> Good morning. I am waiting that money comes on crypto account...
Message 079 From Akira Actor / other Date Not recorded

> Morning. We're waiting too.
Message 080 From Victim Victim Date Not recorded

> Hello. I am desparate to write, I still haven't succedeed to transfer money from my bank account to my [redacted] account. I have sent money on Friday at 8:45 trough [redacted] bank in Slovenia and they sent me confirmation on Friday. Today they have called me that their [redacted] mother bank couldn't send the money to [redacted] account on Malta. I went today at 15:30 in person to [redacted] bank here in Slovenia and they told have made SEPA payment, so I expect that I will have money on [redacted] account tomorrow. I am totally frustrated, because of this, but I can't help. I believ e that money will arrive to this [redacted] account and that I will buy and forward BTC's tomorrow. We really need unlocking here. People inthe company have become totally depressed and me too. We will solve this payment and then really ask for decryting to be made available urgently that we can start decripting immediatelly. Thank you very much in advance.
Message 081 From Akira Actor / other Date Not recorded

> You will get the decryptors immediately after payment.
Message 082 From Victim Victim Date Not recorded

> Morning. I see money went from my [redacted] bank this morning. Now I wait for it to pop up in my [redacted] app... Keep you informed.
Message 083 From Victim Victim Date Not recorded

> Hello, I have just tested BTC withdrawal for 0,008 BTC from my [redacted] account how it works. Could you please check if you've recieved. On [redacted] I have otherwise only 11.000 EUR monthly limit, so I will still have to wait for [redacted].
Message 084 From Akira Actor / other Date Not recorded

> Haven't received anything yet.
Message 085 From Victim Victim Date Not recorded

> It took some time. Now I see on blockchain.com that there is 0.008 BTC in above specified wallet [redacted]. Can you recheck?
Message 086 From Victim Victim Date Not recorded

> Can you please check and confirm that you have recieved 0.008 BTC?
Message 087 From Akira Actor / other Date Not recorded

> 0.008 BTC received.
Message 088 From Victim Victim Date Not recorded

> Thank you. I am doing everything that you will recieve difference to 105.000 USD within next two hours and will keep you updated. I would really kindly ask that we get this decryptors then as soon as possible that we can start decrypting today. Thank you.
Message 089 From Akira Actor / other Date Not recorded

> Thank you. We're ready.
Message 090 From Victim Victim Date Not recorded

> Hello, my contact is in GMT+9hrs time, so I wait that he wakes up and transfers. I will be online again around midnight CET time.
Message 091 From Victim Victim Date Not recorded

> Banks are taking too much time.
Message 092 From Akira Actor / other Date Not recorded

> Got it, thanks.
Message 093 From Victim Victim Date Not recorded

> Hello, just to inform that payment of [redacted] btc has been initiated.
Message 094 From Victim Victim Date Not recorded

> Enclosed you find transaction link
Message 095 From Victim Victim Date Not recorded

> https://blockstream.info/tx/[redacted]
Message 096 From Victim Victim Date Not recorded

> I would now kindly ask that you provide us as discussed full package: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future.
Message 097 From Victim Victim Date Not recorded

> We will learn from this...
Message 098 From Akira Actor / other Date Not recorded

> I see. Unconfirmed yet.
Message 099 From Akira Actor / other Date Not recorded

> unlockers.7z // 1.55 MB
Message 100 From Akira Actor / other Date Not recorded

> unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line same arguments works with esxi decryptor
Message 101 From Victim Victim Date Not recorded

> Hello, thank you for unlocker. Can we please get instructions how to unlock Vmware platform?
Message 102 From Akira Actor / other Date Not recorded

> There is a different unlocker for each system. If it's ESXi - you should use the decryptor for linux. If we're talking about Windows, you should use the.exe unlocker.
unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line same arguments works with esxi decryptor
Message 103 From Victim Victim Date Not recorded

> Hello, when can we expected of delivary 2) evidence of data removal; 3) security report on vulnerabilities we found;
Message 104 From Akira Actor / other Date Not recorded

> I will provide in an hour.
Message 105 From Akira Actor / other Date Not recorded

> [redacted]_dellog.txt // 2.54 MB
Message 106 From Akira Actor / other Date Not recorded

> Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate:
1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc.
We guarantee that we will not sell or publish your data, keep this conversation private, and delete this chat later. We won't come back for more money after payment and we won't attack you again.
We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.
Message 107 From Victim Victim Date Not recorded

> Thank you!
Message 108 From Victim Victim Date Not recorded

> Is it possible to share what means initial access? Which username (I assume also password) was available on dark web?
Message 109 From Victim Victim Date Not recorded

> At least info on username and if password was also available? Thank you.
Message 110 From Akira Actor / other Date Not recorded

> It was VPN credentials. We get access from different people on the darknet, this information is not in public domain. We recommend that you change your VPN credentials and reconsider your password policy - there is nothing to worry about anymore.
Message 111 From Victim Victim Date Not recorded

> Thajnk you!
Message 112 From Akira Actor / other Date Not recorded

> You're welcome.

Actor	Akira
Record ID	20231209
Source filename	20231209.json
Record date	Dec 09, 2023
Participants	Akira, Victim
Message count	112
Source file	Open source JSON