Akira — 20240718

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date Not recorded

   > hello?

2. Message 002 From Akira Actor / other Date Not recorded

   > Hello.

3. Message 003 From Akira Actor / other Date Not recorded

   > You've reached Akira support chat. Currently, we are preparing the list of data we took from your network. For now you have to know that dealing with us is the best possible way to settle this quick and cheap. Keep in touch and be patient with us. Do you have a permission to conduct a negotiation on behalf of your organization? Once we get your reply you will be provided with all the details.

4. Message 004 From Victim Victim Date Not recorded

   > lagging here, internet poor, maybe slow respons from me

5. Message 005 From Victim Victim Date Not recorded

   > I do

6. Message 006 From Akira Actor / other Date Not recorded

   > Please wait for details.

7. Message 007 From Akira Actor / other Date Not recorded

   > List.7z // 394 KB

8. Message 008 From Akira Actor / other Date Not recorded

   > These files were taken from your network prior to encryption. You can pick 2-3 random files up to 10mb size from the list and we will upload them to this chat as a proof of possession. To prove that we can properly decrypt your data you can upload 2-3 encrypted files up to 10mb size to our chat and we will upload decrypted copies back.

9. Message 009 From Akira Actor / other Date Not recorded

   > We offer: 1) full decryption assistance; 2) evidence of data removal; 3) security report on vulnerabilities we found; 4) guarantees not to publish or sell your data; 5) guarantees not to attack you in the future. Let me know whether you're interested in a whole deal or in parts. This will affect the final price.

10. Message 010 From Victim Victim Date Not recorded

    > Could I see 2022-01-03 [redacted].pdf and 2023-10-10 [redacted].jpg

11. Message 011 From Victim Victim Date Not recorded

    > I cannot upload files for decrypt. Servers are encrypted.

12. Message 012 From Akira Actor / other Date Not recorded

    > You can upload any encrypted files you can find like log or configs. Please wait for files.

13. Message 013 From Akira Actor / other Date Not recorded

    > files.7z // 939 KB

14. Message 014 From Akira Actor / other Date Not recorded

    > Here us the files. Let us know your progress with encrypted ones.

15. Message 015 From Victim Victim Date Not recorded

    > still looking for encryptet files - can only see encrypted servers, so far

16. Message 016 From Victim Victim Date Not recorded

    > It write 413 Request Entity Too Large when I try upload file

17. Message 017 From Akira Actor / other Date Not recorded

    > Let me know if you need the whole deal or in parts please. We are standing by to the files.

18. Message 018 From Victim Victim Date Not recorded

    > If you can decrypt we like part 1 and 4

19. Message 019 From Akira Actor / other Date Not recorded

    > You can give us log or config files for test.

20. Message 020 From Victim Victim Date Not recorded

    > All files we try upload write 413 Request Entity Too Large

21. Message 021 From Akira Actor / other Date Not recorded

    > Make sure that the file size does not exceed 10mb. Our size limit is 10mb.

22. Message 022 From Victim Victim Date Not recorded

    > files are only 4 MB

23. Message 023 From Akira Actor / other Date Not recorded

    > Try uploading them through any file sharing service. You can share the link.

24. Message 024 From Victim Victim Date Not recorded

    > https://www.dropbox.com/[redacted]

25. Message 025 From Akira Actor / other Date Not recorded

    > Wait a bit.

26. Message 026 From Akira Actor / other Date Not recorded

    > decrypted.7z // 22.1 KB

27. Message 027 From Akira Actor / other Date Not recorded

    > Please review. Ready to discuss payment?

28. Message 028 From Akira Actor / other Date Not recorded

    > The fourth option means we would have to delete your data, so this is just a basic guarantee of the second option. The price for the mentioned services is $225,000.

29. Message 029 From Victim Victim Date Not recorded

    > Hi. Sorry for the delay in respons, but things are really hectic here. And people want to do different things. Also stupid things. I hope we can manage, so we can all get on with what we do. The company is not in a good position right now so it is a lot to handle right now. I try my best.

30. Message 030 From Akira Actor / other Date Not recorded

    > We are waiting for your response today.

31. Message 031 From Victim Victim Date Not recorded

    > I really do want to find a solution, I promise, but some people here think it is the wrong way to go. It is hard convincing them. What should I tell them? Any help is highly appreciated. Thanks

32. Message 032 From Victim Victim Date Not recorded

    > Hi. I was unable to access the chat for some time. It worries me. Any problems?

33. Message 033 From Victim Victim Date Not recorded

    > Hi. Things are super difficult here. Some of the others seem to have abandoned all hope. We have lost a lot of customers in the last year and we have had to downsize, we have fired colleagues. We own unsellable buildings. People are disillusioned, but I go on pushing and fighting. Any help from you is appreciated.

34. Message 034 From Akira Actor / other Date Not recorded

    > Hi. We've heard these stories many times. What do you offer?

35. Message 035 From Victim Victim Date Not recorded

    > Sorry to hear this. This is not everyday for us. This is our first time. I do all I can to find solutions, so we can move on. Honestly, it is not easy, both because of liquidity and ability. They don't understand the picture as clear as me. I try all I can to make them. I will get back to you.

36. Message 036 From Akira Actor / other Date Not recorded

    > We are waiting for your offer asap.

37. Message 037 From Victim Victim Date Not recorded

    > It sounds like you are frustrated that we cannot be more concrete. I am myself super frustrated. Sometimes I feel my head is about to explode.

38. Message 038 From Victim Victim Date Not recorded

    > I do feel like we might be able to drive this in the right direction. I hear a lot of fears but you being professional as you are really helps them see there might be a way. I thank you for being patient with me, I need to keep the situation stable and I will do all I can.

39. Message 039 From Akira Actor / other Date Not recorded

    > Will we see a counter offer from you today?

40. Message 040 From Victim Victim Date Not recorded

    > Yes, I really hope that I can give it to you before Thursday is over. There are movements in the right direction.

41. Message 041 From Akira Actor / other Date Not recorded

    > We are going to close the deal this week in any case.

42. Message 042 From Victim Victim Date Not recorded

    > Look, I am doing everything I can but the company is in a very bad place. I am just trying to be honest with you and I am sorry that things are taking longer than both you and I would like. Trust me I just want everything to fall in place quickly, shake hands with you and get on with trying to save the rubbles of a company. I am working my ass off and this feels threatening to me when you write like this, I really need you not to do this.

43. Message 043 From Akira Actor / other Date Not recorded

    > We are waiting for your offer today.

44. Message 044 From Victim Victim Date Not recorded

    > The last 24 hours have been absolutely rough. I almost didn’t sleep last night, and when I finally fell asleep I got woken by my smallest child who was sick all over the place.

45. Message 045 From Victim Victim Date Not recorded

    > I am sorry if this is annoying for you and I guess you must hear a lot from people that they are in a bad place, but I just had to get that off my chest. I must try to find the strength to keep everyone in line here so we can find a way with you.

46. Message 046 From Victim Victim Date Not recorded

    > I am grateful for your patience, it is a very important and hard moment right now and they are hurting a lot because of a really bad year as well as other things. But I am on it and I will update you as soon as I can.

47. Message 047 From Akira Actor / other Date Not recorded

    > Waiting for the update.

48. Message 048 From Victim Victim Date Not recorded

    > Thanks. The company is in an crazy internal fight, people shout at each other, disagreeing on what to do. Some think we should try to find a solution with you (my team), some think that would be a dangerous mistake, potentially unlawfull and they want to try finding technical ways, and again some seem to have been giving up because they think the company was going down no matter what, due to really bad economy, closed projects and laid off people. They actually think this situation can be used for a restructuring process. No matter what I still believe that my team will get (some of) its way, but maybe in a very limited fashion. Perhaps a group of us will have to work out something on our own. These are the discussions. It is fucked up, but I don't quit. I will get back.

49. Message 049 From Victim Victim Date Not recorded

    > Quick update again: I have done a little progress, although it is not easy, but moving now. I am trying to come up with funds to offer. How would we transfer the money to you? It should be USD, right?

50. Message 050 From Akira Actor / other Date Not recorded

    > Thank you for the update. We hope you will come to an agreement soon because we will not wait long. Anyway restructuring you mentioned will be more expensive that a deal with us. We can help with the price and we can accept $200,000 this week. It is up to you to decide what way to choose. Let us know your decision asap please. We need to move on.

51. Message 051 From Victim Victim Date Not recorded

    > I do hear that you want to move this on. I have been thinking to myself that you might also be in a situation where you need to show others progress. I think a lot about this and I am worried that I create expectations that I am not fully able to meet. At least not as quickly as I would like. I would rather be honest and realistic with you.

52. Message 052 From Victim Victim Date Not recorded

    > I am very grateful for you giving the new amount but I fear it is a mountain we are too small and weak to climb.

53. Message 053 From Victim Victim Date Not recorded

    > But do know this: I will do everything I can to try to get to a solution with you. I just need to be certain of what we can actually come up with for real. Also we need to discretely exchange our local currency into USD.

54. Message 054 From Victim Victim Date Not recorded

    > Can I ask how a deal would work? Will you send us an invoice or how does it work with the payment?

55. Message 055 From Akira Actor / other Date Not recorded

    > We accept bitcoins. To gain bitcoins you have to go to any exchange platform as binance or coinbase. Here are the guides: https://www.coinbase.com/how-to-buy/bitcoin https://www.binance.com/en/how-to-buy/bitcoin You also can buy bitcoin from any local brokers. If you withdraw funds from your bank account, then you have to inform the bank that you need this money for investment purposes only.

56. Message 056 From Victim Victim Date Not recorded

    > Oh, I understand. That is making it a whole lot more complicated, I have no experience with bit coins and that sort. Are you sure we can get more than usd 5000 each day on those places? It looks like it might take a lot of time to even get approved on their site.

57. Message 057 From Victim Victim Date Not recorded

    > It has been very hard coming up with whatever little usd I might be able to offer you, also because I have had to keep the ghost of reconstruction away. I am almost ready to tell you what we can manage but I need to make sure that I look for even small additional amounts everywhere, as I fear that what we have is something that you will think is not very much.

58. Message 058 From Akira Actor / other Date Not recorded

    > So what do you have? Let us know asap.

59. Message 059 From Victim Victim Date Not recorded

    > Yes. Stand by. Thank you.

60. Message 060 From Victim Victim Date Not recorded

    > Ok so I know you may think I am not serious-minded and quite annoying. I fear that you will take this the wrong way and I pray you will not be too offended. I am really doing all that I can. I have USD 71500.

61. Message 061 From Akira Actor / other Date Not recorded

    > We are not offended at all but your offer is not enough to close the deal unfortunately. We see you want a resolution a even made an offer that is not really bad. We want to come to an agreement with you and we suppose it is possible so we are ready to accept $170,000 and get this over with. I believe you and your colleagues are able to see that the agreement with us is more that possible. Let us know asap.

62. Message 062 From Victim Victim Date Not recorded

    > I am very grateful for this and that you are trying to do what you can to make this work and I so much wish that we had all of that so we could end this today. I can feel you are really trying to help. But I am afraid we don’t have it. I apologise to you.

63. Message 063 From Akira Actor / other Date Not recorded

    > You have to give us a renewed offer if you want this to end positively.

64. Message 064 From Victim Victim Date Not recorded

    > I do. I understand you need me to improve. I am trying, but it is super hard.

65. Message 065 From Akira Actor / other Date Not recorded

    > We believe you will cope with it. $170,000 is a price we can agree on with you. Your colleagues should understand that. We are waiting for updates.

66. Message 066 From Victim Victim Date Not recorded

    > Thank you, I understand. I am trying so hard to find alternatives. I know that you want this to move forward but we are deeply depleted and in big trouble already.

67. Message 067 From Akira Actor / other Date Not recorded

    > We will wait to hear about alternative you will find asap.

68. Message 068 From Victim Victim Date Not recorded

    > Ok. Thank you.

69. Message 069 From Victim Victim Date Not recorded

    > Again I thank you for awaiting me. I must say that right now I feel lost. And desperate. I am doing all I can to better at least a little bit. But even my smallest steps are so heavy. This is so overwhelmingly scary and painful.

70. Message 070 From Victim Victim Date Not recorded

    > Hello again and sorry for my late response. Yet another absolutely awful night, I just want this nightmare to end. But let me give you an update so you know what is going on here: I am fighting on two fronts right now. Getting approved to purchase BTC in more than very small amounts is crazy hard because of regulations I think. I am looking at different options and will know more today, but it is complicated. And as you know, the company is in a sorry state and resources are so limited. Right now the idea of being able to come up with more that I can offer you seems very black. But I understand I need to show you progress and I am doing all I can.

71. Message 071 From Akira Actor / other Date Not recorded

    > We get lots of payments from [redacted]. Everything will be fine.

72. Message 072 From Victim Victim Date Not recorded

    > I really also hope everything will be fine. Im still working on how to exchange, it is not easy. I am right now actively trying to better what we can come up with in terms of amount but I cannot promise anything right now. I will get back to you as soon as I can.

73. Message 073 From Victim Victim Date Not recorded

    > Hi. I am out of alternatives. Out of energy. Out of help. I have spent everything I have raising the amount for you. I really hope you will accept it. I have USD 93.300. Let us get this over with.

74. Message 074 From Akira Actor / other Date Not recorded

    > We appreciate your willingness to cooperate and you efforts of course but we are still far apart from each other. We will wait for better number on Monday and we hope to finish the deal after we receive your renewed offer.

75. Message 075 From Victim Victim Date Not recorded

    > I was fearing you would say that. I simply don’t know how I can put myself in a situation where I can find more. I don’t know how.

76. Message 076 From Akira Actor / other Date Not recorded

    > Do not give up. Organize a meeting with you colleagues and try to find additional funds for this deal.

77. Message 077 From Victim Victim Date Not recorded

    > I have invested all my energy in meetings. I have had so many. Big and small. And I have fought so hard to get to this.

78. Message 078 From Akira Actor / other Date Not recorded

    > Waiting for positive new from you.

79. Message 079 From Victim Victim Date Not recorded

    > But what do you want me to do to get more? I am really trying my very best. Finding a way to increase the amount is hell - let alone the nightmare it is to getting to the point where I can exchange it to bitcoin

80. Message 080 From Victim Victim Date Not recorded

    > I don’t want to let everybody down. I need your help but I am not a magician. I’m sorry. I don’t know how to make it work the way you want, I wish I did.

81. Message 081 From Victim Victim Date Not recorded

    > I need to go for a late night ride, clear my head, try and see if I can translate my desperation into something. Can I get in contact with you later tonight?

82. Message 082 From Akira Actor / other Date Not recorded

    > Sure. My leadership decided to reduce the price to assist you with the process and we are ready to accept $125,000. I think this amount you can cope with and we can end all this.

83. Message 083 From Victim Victim Date Not recorded

    > I really appreciate that you help me like this, I really do. I pray that you and I can get things to a point where we will achieve what we have been working on. Thank you for making my cases with them.

84. Message 084 From Victim Victim Date Not recorded

    > To try to make just some movement I went for a ride yesterday as you know.

85. Message 085 From Victim Victim Date Not recorded

    > I took a big chance and my neck is on the line for real here. I rode out to meet some very rough people to solve the bitcoins. I need this to work man. I pray to God I don’t need to talk to them again.

86. Message 086 From Victim Victim Date Not recorded

    > But I have it in bitcoin for you now, we can end this now, I know it’s not all you ask but I have it converted now. I have BTC 1,562 ready I have screenshot for you.

87. Message 087 From Victim Victim Date Not recorded

    > wallet.png // 96.5 KB

88. Message 088 From Akira Actor / other Date Not recorded

    > $100,000 and we have a deal here.

89. Message 089 From Victim Victim Date Not recorded

    > Wait

90. Message 090 From Victim Victim Date Not recorded

    > I am desperately trying to get the last bit. What bitcoin-address should we send to?

91. Message 091 From Akira Actor / other Date Not recorded

    > This one [redacted].

92. Message 092 From Victim Victim Date Not recorded

    > I have been fighting so hard for this. Can we agree that 1) we transfer BTC 1.7235 to your wallet [redacted] and 2) you will then send us the decryptors and provide full help with decryption, and 3) you will then send us a security report, and 4) you promise not to publish and/or sell our data, and 5) you guarantee that you will not carry out any future attacks against us, and 6) we mutually agree to keep all of this a secret Do you agree to this?

93. Message 093 From Akira Actor / other Date Not recorded

    > We agree. How soon are you able to transfer BTC 1.7235?

94. Message 094 From Victim Victim Date Not recorded

    > We have an agreement, thank you. I have sent a test transfer to your wallet. Can I ask you to please confirm that you have received it and the amount I have sent. Thank you.

95. Message 095 From Akira Actor / other Date Not recorded

    > 0.00125 BTC received. You can proceed with the rest.

96. Message 096 From Victim Victim Date Not recorded

    > I have now sent the rest. Can I ask you to please confirm when they are received and then send the decryptors? Thank you

97. Message 097 From Akira Actor / other Date Not recorded

    > unlockers.7z // 2.1 MB

98. Message 098 From Akira Actor / other Date Not recorded

    > unlocker.exe -p="path_to_unlock" unlocker.exe -s="C:\paths.txt" where "paths.txt" is a list of paths for the decryptor, each path on a new line ESXi commands 1) chmod +x unlocker 2)./unlocker -p="/vmfs/volumes"

99. Message 099 From Victim Victim Date Not recorded

    > So, It seem as if the decryptors are working (still in progress). When can we expect the Data removal and evidence that data has been removed? And the security report?

100. Message 100 From Akira Actor / other Date Not recorded

     > Yes. We'll provide everything soon.

101. Message 101 From Victim Victim Date Not recorded

     > Thank you.

102. Message 102 From Akira Actor / other Date Not recorded

     > Deletion.7z // 250 Bytes

103. Message 103 From Akira Actor / other Date Not recorded

     > Initial access to your network was purchased on the dark web. Then kerberoasting was carried out and we got passwords hashes. Then we just bruted these and got domain admin password. Spending weeks inside of your network we've managed to detect some fails we highly recommend to eliminate: 1. None of your employees should open suspicious emails, suspicious links or download any files, much less run them on their computer. 2. Use strong passwords, change them as often as possible (1-2 times per month at least). Passwords should not match or be repeated on different resources. 3. Install 2FA wherever possible. 4. Use the latest versions of operating systems, as they are less vulnerable to attacks. 5. Update all software versions. 6. Use antivirus solutions and traffic monitoring tools. 7. Create a jump host for your VPN. Use unique credentials on it that differ from domain one. 8. Use backup software with cloud storage which supports a token key. 9. Instruct your employees as often as possible about online safety precautions. The most vulnerable point is the human factor and the irresponsibility of your employees, system administrators, etc. We wish you safety, calmness and lots of benefits in the future. Thank you for working with us and your careful attitude to your security.

104. Message 104 From Victim Victim Date Not recorded

     > Thank you for the fast delivery of the decryptors, og after that the delivery of the deletion log and the security report. I guess it is time to say goodbye and go our separate ways.Thanks for listening to my troubles and helping me get through this. I appreciate your professionalism.

105. Message 105 From Akira Actor / other Date Not recorded

     > You are welcome! Take care!