extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

REvil — 20210604

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 10 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
REvil
Record date
Jun 04, 2021
Messages
10
Participants
REvil, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From REvil Actor / other Date

    Hello,

    We are REvil Group. We want to inform that your company local network have been hacked and encrypted. We have all your local network data. The Price to unlock is $5.500,000. Now we're keeping it a secret, but if you do not reply us within 3 days it will be posted on our news-site. Think about the financial damage to your stock price from this publication. In case of successful negotiations we guarantee that you will get decryptors for all your machines, non recoverable removal of downloaded data and security report on how you were hacked to fix your vulnerabilities. We hope that you can correctly assess the risks for your company. You can find more information about REvil group in Google.

    Posting on our blog and further publications in the media will lead to significant losses for your company: court and government fines, data recovery, loss of reputation, abandonment of clients, drop in limits.

    But don't panic! We are in business, not in war. We can unblock your data and keep everything secret. All we need is a ransom. In this case, you also get: a security report, a complete tree of compromised data files, permanently deleting downloaded data, support with tips on unlocking and protecting.

  2. Message 002 From Victim Victim Date

    I'm a little confused. Your message says 3 days but your website says 19 hours. Your decryption tool doesn't do us any good since we are in the process of recovering, but you may interest us with the data that you say you have taken. Can you show us what you took?

  3. Message 003 From REvil Actor / other Date

    You were too slow when trying to assess the damage and did not write to us

  4. Message 004 From REvil Actor / other Date

    Of course wait for answer

  5. Message 005 From Victim Victim Date

    Will we have this today? Please increase the timer, there's no way we can make any payment in only 14 hrs

  6. Message 006 From REvil Actor / other Date

    3 day added

  7. Message 007 From REvil Actor / other Date

    Yes we prepaid proof of hack

  8. Message 008 From Victim Victim Date

    Okay please send the proof of what you took from our network

  9. Message 009 From REvil Actor / other Date

    ok

  10. Message 010 From REvil Actor / other Date

    https://privatlab.com/s/v/[redacted]

    pass for download: [redacted] pass for archive: [redacted]

    https://privatlab.com/s/d/[redacted]#delete