Nightspire — 20260203

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Nightspire Actor / other Date 2026-02-03

   Hello. You have reached an Nightspire Support Chat.You need to know that dealing with us is the best choice to get back you infrastructure.

2. Message 002 From Victim Victim Date Not recorded

   Hello. So what exactly did you do and what do you want?

3. Message 003 From Victim Victim Date Not recorded

   The amount you are asking for in that text file is going to be very difficult for us to do

4. Message 004 From Nightspire Actor / other Date Not recorded

   All of your internal servers and virtual infrastructure have been encrypted by NIGHTSPIRE ransomware, and we have also copied your sensitive data.

5. Message 005 From Nightspire Actor / other Date Not recorded

   Of course, we can provide you full file list we have.

6. Message 006 From Nightspire Actor / other Date Not recorded

   And you can verify how decryption works correctly. Before paying, we will provide you decryption test to ensure your files decrypted correctly. After when you pay us, we will provide you decryption key & tools to decrypt by yourself.It takes only 6 hours to decrypt all your files and recover your infrastructure, even though your company's infra is big.

7. Message 007 From Nightspire Actor / other Date Not recorded

   If you can see in above image, your company already listed as victim on our site. For your privacy, we hide your full name. If you make payment in 48 hours, we will decrypt your files, provide file deletion logs, and permanently delete your company on our website to protect your privacy.

8. Message 008 From Nightspire Actor / other Date Not recorded

   But if you don't make payment in 48 hours, your company name will be released. And it may cause damage your company's reputation.

9. Message 009 From Victim Victim Date Not recorded

   Ok I’ll collect some encrypted files. Waiting for that file list from you for now.

10. Message 010 From Nightspire Actor / other Date Not recorded

    FileLists.zip: 478775KB

11. Message 011 From Nightspire Actor / other Date Not recorded

    This is a list of files.You can send us three files that do not contain sensitive data for decryption testing.

12. Message 012 From Nightspire Actor / other Date Not recorded

    Did you confirm the file list? If you intend to resolve this matter quickly, you must act within 48 hours. 12 hours have already passed. After the 48-hour deadline, the price will no longer be 6 BTC. It will increase to 8 BTC.

13. Message 013 From Victim Victim Date Not recorded

    Well we cannot even afford 6 bitcoin so we will need to come to some arrangement since bitcoin is so expensive. We have reviewed the list. We are selecting mundane file names to have you reproduce. We are attaching some encrypted files to see you are able to unlock

14. Message 014 From Victim Victim Date Not recorded

    https://limewire.com/[redacted]

15. Message 015 From Nightspire Actor / other Date Not recorded

    Regarding payment, considering your company's annual revenue of $15 million, the initial ransom demand is only 3% of your revenue. Furthermore, since you stated you are willing to pay within 48 hours, we have already discounted the amount to 6 BTC, which is 2% of your revenue.

16. Message 016 From Nightspire Actor / other Date Not recorded

    The default ransom demand is 5% of every company's revenue, but we have set it at 2% for your company. This is the best amount we can offer. I think you have to discuss this amount with your company management. We believe you can easily afford this amount. Let us know if you have any suggestions for a different amount. How much can you pay?

17. Message 017 From Nightspire Actor / other Date Not recorded

    Decrypted_files.zip: 1997701KB

18. Message 018 From Nightspire Actor / other Date Not recorded

    This file is a decrypted version.

19. Message 019 From Victim Victim Date Not recorded

    The IT team is reviewing the file you sent back. I should have file names back soon. Regarding price, It does not make sense to price off revenue for our business. We have very low margins and most of our money is locked up in inventory. I spoke with finance and between our current cash balance, payroll, and liabilities due, we can likely afford 2 to 3 bitcoin at its current price. Once we get comfortable with your promises we should be able to move quickly

20. Message 020 From Nightspire Actor / other Date Not recorded

    If you pay within 6 hours, we can accept 3.5 BTC, and we will provide you with a decryption tool and key. However, if you fail to pay within 6 hours, you will be charged 6 BTC.This means that if you pay 3.5 BTC within 6 hours, the company's infrastructure can be restored. Because the decryption process is so fast, the company can resume operations within 8 hours.

21. Message 021 From Victim Victim Date Not recorded

    That might be doable but will likely need a little more than 6 hours as we need to find a way to optain the bitcoin. We have already started the process of getting an exchange account so please just be patient there. And just to be clear, 3.5 bitcoin and you will give us a working decryptor tool, delete our data, and never attack or leak about us in the future?

22. Message 022 From Nightspire Actor / other Date Not recorded

    Yes, if you pay within 6 hours, we will provide you with a decryption tool, key, and file deletion log. We will never attack again and will never leak any information about your company. Furthermore, once payment is completed, we will remove your company name (represented by an *) from our site. But remember, you have to make a payment in 6 hours from now on. After 6 hours, the amount will increase to 6 BTC.

23. Message 023 From Victim Victim Date Not recorded

    We should be able to get it to you in 6 hours. In the meantime can you go ahead and unlock that file? Here is the other file you need. Also please produce these files from the file tree you gave us: [redacted].jpg, [redacted].jpeg, [redacted].png

24. Message 024 From Victim Victim Date Not recorded

    Looks like we need a wallet for when we are ready?

25. Message 025 From Nightspire Actor / other Date Not recorded

    ReqFiles.zip: 5103663KB

26. Message 026 From Nightspire Actor / other Date Not recorded

    Here are the files you need: "[redacted].n*m" is the decrypted file. And you'll also required "[redacted].jpeg," "[redacted].png," and "[redacted].jpg."bc1q[redacted]

27. Message 027 From Nightspire Actor / other Date Not recorded

    This is our wallet address. If you're ready, first send a test amount of less than $1,000 first, then send the remaining 3.5 BTC.

28. Message 028 From Victim Victim Date Not recorded

    Should be ready to pay soon. After a test we will send you 3.5 bitcoin and you will provide what you promised. We'd also like to know how you did this attack so we can be more secure in the future.

29. Message 029 From Nightspire Actor / other Date Not recorded

    Yes, we will. First, send a test amount of $100 to our wallet. Then, after confirming, please send 3.5 BTC.

30. Message 030 From Nightspire Actor / other Date Not recorded

    1. We will provide you with a decryption tool and key. 2. We will provide you a permanently file deletion log. 3. We will inform you of how we accessed your internal network. 4. We will never attack again.

31. Message 031 From Victim Victim Date Not recorded

    Test sent

32. Message 032 From Nightspire Actor / other Date Not recorded

    0.00001000 BTC Received.

33. Message 033 From Nightspire Actor / other Date Not recorded

    But it's now pending. Did you send 0.00001000 BTC?

34. Message 034 From Victim Victim Date Not recorded

    Yes we did

35. Message 035 From Nightspire Actor / other Date Not recorded

    Confirmed, Send us remain amount.Sent

36. Message 036 From Nightspire Actor / other Date Not recorded

    Confirmed. We will send decryption tool & Key.

37. Message 037 From Nightspire Actor / other Date Not recorded

    decryption.7z: 1761312KB

38. Message 038 From Nightspire Actor / other Date Not recorded

    The password is [redacted].

39. Message 039 From Nightspire Actor / other Date Not recorded

    [redacted] readme.7z: 486KBThis file is a description file on how to decrypt.

40. Message 040 From Victim Victim Date Not recorded

    Thanks for instructions. will let you know how it goes and if we have any questions

41. Message 041 From Nightspire Actor / other Date Not recorded

    We have already removed your company name (marked with *) from our blog site.

42. Message 042 From Victim Victim Date Not recorded

    ok that was helpful... will keep you informed. Waiting for the rest of what you promised. Proof of deletion and how you did this to us? Thank you.

43. Message 043 From Nightspire Actor / other Date Not recorded

    [redacted] file_deletion_log.zip: 274520KB

44. Message 044 From Nightspire Actor / other Date Not recorded

    And we will never attack again, as we promised.

45. Message 045 From Nightspire Actor / other Date Not recorded

    And about the init access, I'll give you a hand. [redacted].You will understand what I mean.