extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

BlackMatter — 20210907

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 77 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
BlackMatter
Record date
Sep 07, 2021
Messages
77
Participants
BlackMatter, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From BlackMatter Actor / other Date

    Hello and welcome to BlackMatter. How may I help you?

  2. Message 002 From Victim Victim Date

    Hello

  3. Message 003 From Victim Victim Date

    I need help with decrypt my data

  4. Message 004 From BlackMatter Actor / other Date

    To decrypt your files you have to purchase the decryption software. It costs $15m for you.

  5. Message 005 From Victim Victim Date

    This is too hiigh a price. Give me proof that the price is adequate for the data you have.

  6. Message 006 From BlackMatter Actor / other Date

    First of all, can you introduce yourself, state the company name and your position in it.

  7. Message 007 From Victim Victim Date

    I am a spokesperson for the company and I will sell the information to my customer. Because this is not secure communication, I do not want to state the name of the company and I assume that we will delete this chat after the meeting.

  8. Message 008 From Victim Victim Date

    I am authorized to communicate with you on behalf of the company and to establish conditions that will be acceptable to both parties.

  9. Message 009 From Victim Victim Date

    First of all, I would be happy if we set a price that is negotiable. Next, it would be good to submit information about the data you have in your possession so that we can consider paying the ransom and start negotiating the price.

  10. Message 010 From BlackMatter Actor / other Date

    We have the doubts you are from company we need the proofs that you are from there.

  11. Message 011 From BlackMatter Actor / other Date

    So how can you prove it?

  12. Message 012 From Victim Victim Date

    I can't prove it. We're gonna have to trust each other.

  13. Message 013 From Victim Victim Date

    If you want to pay, then this is the only way to come to an agreement. So that emotions are not used in the negotiations, I am here as an intermediary. My client doesn't want to negotiate, even though it seems to be the only option. Although they have backups, but the restoration will take some time, so I would like to negotiate an adequate price.

  14. Message 014 From BlackMatter Actor / other Date

    You cant prove it because you don't know it. This is just confirmed our doubts have a nice day.

  15. Message 015 From Victim Victim Date

    We are a protected society and I cannot afford to openly write who it is. I only know the owner of the company who owns several companies.

  16. Message 016 From Victim Victim Date

    If you do not want to cooperate, then I will pass this information on to the customer and the media to make it obvious that BlackMatter are a group of crooks.

  17. Message 017 From BlackMatter Actor / other Date

    This is ridiculous, you can prove it in hundreds different ways, without compromising so called “privacy”.

  18. Message 018 From Victim Victim Date

    Give an example.I only know the owners of the companies.

  19. Message 019 From BlackMatter Actor / other Date

    To start a cooperation, we have to know with whom we a dealing and you failing it. So far you looks as some boring guy who got a sample from virus total and obtained the chat link.

  20. Message 020 From Victim Victim Date

    They found this file in their system and that's why I came to your page C:\[redacted].README.txt

  21. Message 021 From BlackMatter Actor / other Date

    You can upload the company’s letterhead, you can tell to us domain controllers name, name of backing up software it is just a few)

  22. Message 022 From Victim Victim Date

    Actually I don't have much time to deal with authorization. I want to help the customer and negotiate the terms of cooperation. Just because anyone can watch this chat, I don't want to share any information and prove that I am who I am. Do you want to negotiate the price?

  23. Message 023 From BlackMatter Actor / other Date

    So far it looks as your main objective is to f*ck with us)

  24. Message 024 From Victim Victim Date

    The environment is isolated and analyzed by the forensics team and the police. I can't interfere with the investigation, and all the documentation has been encrypted, as the customer told me.

  25. Message 025 From Victim Victim Date

    I certainly don't feel like fucking with you. I want to talk and get this thing resolved as soon as possible.

  26. Message 026 From BlackMatter Actor / other Date

    Here we go again, to negotiate with whom with some random Joe?

  27. Message 027 From BlackMatter Actor / other Date

    Ok, this is simple prove you are from company or just go grab another sample from VT.

  28. Message 028 From Victim Victim Date

    Yes, let's talk about price and what you get for our data. Then we can discuss the price of the decryptor.

  29. Message 029 From Victim Victim Date

    What is VT?

  30. Message 030 From BlackMatter Actor / other Date

    Oh [redacted] you so clever) virustotal.com

  31. Message 031 From Victim Victim Date

    Oh, I see. So how do we do it?

  32. Message 032 From BlackMatter Actor / other Date

    You have the options 1. Internal windows domain name. 2. Domain administrators name. 3. Backup software name. This information aren’t locked by encrypting software or police)

  33. Message 033 From Victim Victim Date

    1) [redacted]

  34. Message 034 From Victim Victim Date

    2) administrator

  35. Message 035 From BlackMatter Actor / other Date

    2) administrator this is too generic give us another one

  36. Message 036 From Victim Victim Date

    [redacted]

  37. Message 037 From BlackMatter Actor / other Date

    Ok, John thank you. So you see the price, you need to pay it.

  38. Message 038 From Victim Victim Date

    Are we really not? This bill was sent to me by their owner. I'm gonna look like a fool if we don't agree on a price.

  39. Message 039 From BlackMatter Actor / other Date

    Your English is too sophisticated for me, can you try again)

  40. Message 040 From Victim Victim Date

    Are we really not? This account was sent by their owner. If we don't make a deal, I'm gonna look like an idiot.

  41. Message 041 From Victim Victim Date

    I don't speak English, so I translate automatically.

  42. Message 042 From BlackMatter Actor / other Date

    You see the demanded price. If you’ll pay it you will get. 1. The decrypting tools. 2. Your data back (we took 1.5TB, PII, NDA, emails, MSSQL databases) 3. A file tree. 4. Explanation how the company was breached.

  43. Message 043 From Victim Victim Date

    The price is not adequate. Give me a price I can pass on to the owner of the company.

  44. Message 044 From BlackMatter Actor / other Date

    We have no idea what a price is adequate for you. We can make 10% discount for fast payment and remove 25% BTC transaction fee. Make the offer. But to make it simple we will not consider the offer less than 7-figure number.

  45. Message 045 From Victim Victim Date

    Our idea was $500,000, but we can negotiate a price of $1,000,000. Give us proof that there is information sensitive enough to be of such value.

  46. Message 046 From BlackMatter Actor / other Date

    Do you want me upload a sample with office documents? The emails and sqls are too big but we have them all.)

  47. Message 047 From BlackMatter Actor / other Date

    One more detail we know the company doesn't have the backups. Rubrik is gone)

  48. Message 048 From Victim Victim Date

    We have offline backups. Ok show me the office document and a screenshot of the database.

  49. Message 049 From Victim Victim Date

    Do you also have the passwords of the domain users? Give me a screenshot.

  50. Message 050 From BlackMatter Actor / other Date

    You have tapes for [redacted] but they are useless without software.

  51. Message 051 From BlackMatter Actor / other Date

    This is the screenshot for DA hashes and passwords. https://ibb.co/[redacted]

  52. Message 052 From Victim Victim Date

    We have a backup created by other software and transferred to a SAN to a backup data center. Restoration will take a long time, but it is possible. What databases do you have?

  53. Message 053 From BlackMatter Actor / other Date

    Yo can get the sample by following link. https://privatlab.com/m/v/[redacted] We will not make DB screenshots too much work.

  54. Message 054 From BlackMatter Actor / other Date

    We have dbs from [redacted]SQL SQL2014Test [redacted]SQL1 [redacted]-SQL [redacted]-SQL

  55. Message 055 From Victim Victim Date

    Data in databases should be encrypted. Just because you have database servers doesn't mean anything.

  56. Message 056 From BlackMatter Actor / other Date

    Should or is? )

  57. Message 057 From Victim Victim Date

    According to IT, it should be. Let's make a deal like this. If the data in the database is encrypted, we'll pay you $100,000 to decrypt it for us. If the data in the databases is not encrypted, then we'll pay you $700,000. $700,000 is the price we have to invest in recovery, and if the recovery with the decryptor is faster, then we'll save money on service outages.

  58. Message 058 From BlackMatter Actor / other Date

    To complicated, we said what will provide if we’ll agree on price. $700k is unacceptable.

  59. Message 059 From Victim Victim Date

    Okay, then the price is $1,000,000 if the data is readable.

  60. Message 060 From BlackMatter Actor / other Date

    Without any conditions, you are paying for decrypting tools and fast recovery, the data is collateral. You will not recover so easily without decryptor. We can do negotiations pretty long; time is on our side. If you are want to finish this fast make the acceptable offer.

  61. Message 061 From Victim Victim Date

    The data you hold is worse for us than having to recover it. The data you hold is worth no more than $1,000,000, which is why we are offering this price. We can restore the data from offline backups (we have tested this). A higher price than $1,000,000 is not acceptable to us. If you don't accept this price, then I need to check with the owner of the company what we will do next and if we can offer more money.

  62. Message 062 From BlackMatter Actor / other Date

    How you evaluate data’s price can I see a formula?

  63. Message 063 From BlackMatter Actor / other Date

    You can do incremental and we can do decremental steps, make the offer that we can turn down. 1 is to far away from 15.

  64. Message 064 From Victim Victim Date

    We evaluate it subjectively. We have already written to people about PII, so the reputational impact has already occurred. We're gonna put new passwords in Active Directory. Office documents aren't that valuable to us. The only thing of value is the databases.

  65. Message 065 From Victim Victim Date

    15 is meaningless. I thought 15 was just a number, but not the actual ransom.

  66. Message 066 From BlackMatter Actor / other Date

    We just checked the random db, data is fine and not encrypted. Have a look. https://ibb.co/[redacted]

  67. Message 067 From Victim Victim Date

    I understand, but for us only the know-how and customer information in the databases is worth anything.

  68. Message 068 From Victim Victim Date

    I can see it now. Then name a price that makes sense for both sides.

  69. Message 069 From BlackMatter Actor / other Date

    Nothing sn meaningless, we did a good pentest for your company it has to be rewarded. $1kk is not enough. Do some consultations and come with a better offer.

  70. Message 070 From BlackMatter Actor / other Date

    One of your competitors was hit the same yesterday if it helps to your feelings.

  71. Message 071 From BlackMatter Actor / other Date

    If you will offer the good price today we can make a decent discount for you.

  72. Message 072 From Victim Victim Date

    I need to check with the management and the owners. What competitor do you think?

  73. Message 073 From BlackMatter Actor / other Date

    By the way they offer much more then you.

  74. Message 074 From Victim Victim Date

    I guess they don't have backup.

  75. Message 075 From BlackMatter Actor / other Date

    You either, you tried to do it on Sunday but you know what has happened.

  76. Message 076 From Victim Victim Date

    We are restoring. I'm gonna go talk to the management.

  77. Message 077 From BlackMatter Actor / other Date

    https://ibb.co/[redacted]