extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

REvil — 20210613

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 132 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
REvil
Record date
Jun 13, 2021
Messages
132
Participants
REvil, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From REvil Actor / other Date

    Hello,

    We are REvil Group. We want to inform that your company local network have been hacked and encrypted. We have all your local network data. The Price to unlock is $1,000,000. Now we're keeping it a secret, but if you do not reply us within 3 days it will be posted on our news-site. Think about the financial damage to your stock price from this publication. In case of successful negotiations we guarantee that you will get decryptors for all your machines, non recoverable removal of downloaded data and security report on how you were hacked to fix your vulnerabilities. We hope that you can correctly assess the risks for your company. You can find more information about REvil group in Google.

    Posting on our blog and further publications in the media will lead to significant losses for your company: court and government fines, data recovery, loss of reputation, abandonment of clients, drop in limits.

    But don't panic! We are in business, not in war. We can unblock your data and keep everything secret. All we need is a ransom. In this case, you also get: a security report, a complete tree of compromised data files, permanently deleting downloaded data, support with tips on unlocking and protecting.

  2. Message 002 From Victim Victim Date

    Okay. I appreciate your introduction. My name is [redacted] and I'm part of the IT team here. My manager is asking if you can show us all of the data that you took?

  3. Message 003 From REvil Actor / other Date

    You will receive complete data only after payment. We can only give an example of the data taken.

  4. Message 004 From Victim Victim Date

    Okay. That may work for now. How long does that example take to get from you?

  5. Message 005 From REvil Actor / other Date

    from several hours to a day

  6. Message 006 From REvil Actor / other Date

    wait for answer.

  7. Message 007 From Victim Victim Date

    Are you here?

  8. Message 008 From REvil Actor / other Date

    Yes

  9. Message 009 From Victim Victim Date

    Will you share the example data today?

  10. Message 010 From REvil Actor / other Date

    We need time. You are not the only one who needs to provide evidence of a break-in

  11. Message 011 From Victim Victim Date

    Okay. Can we discuss this price then? We're a non-profit organization with the majority of services covered by tax payers/state government. We help treat a variety of patients from cancer to mental health. It's very important we get our systems back quickly. My manager said we can promise you an almost immediate payment, but not at $1M. It would be impossible

  12. Message 012 From REvil Actor / other Date

    In case of quick payment, we are ready to offer you a 20% discount

  13. Message 013 From Victim Victim Date

    This is generous, my manager is happy to know you are willing to help us with the price. He thinks even still 20% is too much for us to be able to pay, but said they will discuss it when everyone else is online again. Please send the example files whenever you have them

  14. Message 014 From REvil Actor / other Date

    We are working on it. But you can also make your proposal and my boss will consider it.

  15. Message 015 From Victim Victim Date

    Okay. My manager is willing to make a proposal after we receive the files, so I will keep an eye out for your update.

  16. Message 016 From Victim Victim Date

    Any luck with getting the files so that I can share with my manager? The sooner I send them the files, the sooner we can talk about coming to an agreement.

  17. Message 017 From REvil Actor / other Date

    Part of random lines from the tree file

  18. Message 018 From Victim Victim Date

    Thank you. Can you send me these files? [redacted]passport.pdf, mandatoryreport.docx and [redacted].pdf

  19. Message 019 From REvil Actor / other Date

    file

  20. Message 020 From Victim Victim Date

    You can send the other 2 also?

  21. Message 021 From REvil Actor / other Date

    yes wait

  22. Message 022 From Victim Victim Date

    Okay thank you

  23. Message 023 From REvil Actor / other Date

    file

  24. Message 024 From REvil Actor / other Date

    file

  25. Message 025 From Victim Victim Date

    Thank you I will be right back

  26. Message 026 From Victim Victim Date

    We'd like to move very quickly with you. Given what we do, it's important we have your decryptor as soon as possible to get our systems back so we can keep helping patients. We can't afford the price you indicate on the site, but we can pay you $195,000 today. We already started the wire process to a broker in the US so that it arrives immediately

  27. Message 027 From REvil Actor / other Date

    20% discount its all.

  28. Message 028 From Victim Victim Date

    We can't make that happen. We don't have that kind of funding. Please think this over, we really need our data back and you're the only one who can help us with that.

  29. Message 029 From REvil Actor / other Date

    Your offer is too small

  30. Message 030 From Victim Victim Date

    What do you propose then? Please understand the circumstances we are in. Everything is shut down, we can't help our patients. Everyday we are down, the worse off we are. We need to purchase the tool quickly and in good faith, already hired a broker in the US to assist us and sent him some funds so he can buy crypto quickly for you.

  31. Message 031 From Victim Victim Date

    It's very late here already, I've been working all day but will stay up all night if it means we can have a compromise with you today

  32. Message 032 From REvil Actor / other Date

    We have been administrators of your network for a long time and we know how much you are willing to pay. Our latest offer is 700k but that's all

  33. Message 033 From REvil Actor / other Date

    Our servers have hundreds of gigabytes of your confidential data. You must understand the seriousness of the situation.

  34. Message 034 From Victim Victim Date

    If that is true then you would have seen we are just a non-profit and don't have millions. We don't operate like large companies. Any money we get comes from donations or the government and is used to provide our services. We have many expenses and a low budget. Please understand that even something like $500,000 is a lot of money for us and we can't make that happen. WIth COVID we weren't able to have as many events/fundraisers as usually. These are the drivers of our income, it's been a difficult time for us, everyone really. I can certainly check with the board on what else we can do, but will need to wake some of them so please wait. We seriously need to be back today

  35. Message 035 From REvil Actor / other Date

    We can wait, but ours, we gave you the last sentence

  36. Message 036 From Victim Victim Date

    Are you the owner for REvil?

  37. Message 037 From Victim Victim Date

    If you are, please find it in your heart to help us here. We'll never have $700k and I will do what I can to figure out where to pull money from, but we need help

  38. Message 038 From REvil Actor / other Date

    no, support.

  39. Message 039 From Victim Victim Date

    Okay I got in touch with some of the board, they want me to express how important it is that we reach an agreement today. We don't have time to waste and I can pay you immediately. We have confirmation the US broker received our money transfer. The budget we have is fixed annually so we can't reallocate funding. The board was able to connect with a partner that committed to donating sooner than normal. We can pay you $255k right now. Thank you

  40. Message 040 From REvil Actor / other Date

    We have too much sensitive data to accept such a low offer. 650k and we agree

  41. Message 041 From Victim Victim Date

    It's impossible. It would take months for us to get that kind of money. Please think on our offer. Please discuss with your team internally. This is very serious for us and we need to pay you today. We have no other way to get money. We were lucky to find the partner to help us out this time

  42. Message 042 From REvil Actor / other Date

    You should make an offer above otherwise we will not be able to agree

  43. Message 043 From Victim Victim Date

    I don't think we can get much more than what we offered. Please talk to your team/boss and let me know. $650k is impossible, $500k is impossible. We are 100% ready to pay you immediately. I will be here until the job is done.

  44. Message 044 From REvil Actor / other Date

    Then we will not be able to agree

  45. Message 045 From Victim Victim Date

    Did you talk to them and explain the scenario? We're doing everything we can here and are ready to pay asap. I'm sure you have much larger clients that can pay this kind of amount, but that's not us. We don't want to waste any more of your time on this, I'm sure you are talking to many people like me at the same time. Please reconsider our offer and see if you can accept something closer to what we offered!

  46. Message 046 From REvil Actor / other Date

    650 is the last thing my boss has to offer. The price for selling your data will be much higher

  47. Message 047 From Victim Victim Date

    We can never do it! The original asking price was set too high for us. You have our files and like you said, were on our systems for a while. I don't doubt this at all. You can check our files/systems and see we never had this kind of money. DId you tell your boss we can pay you right now??

  48. Message 048 From REvil Actor / other Date

    I passed the information directly to the boss and everything he has to offer 650k

  49. Message 049 From Victim Victim Date

    I just called the broker company helping us with payment and they said good things about you and historically REvil has given much larger discounts than 35%. Please if you can offer a better price we will do our best to figure this out. It's very late here, I'm very tired but need to get this completed

  50. Message 050 From REvil Actor / other Date

    If you are willing to pay quickly, we will approve the amount of 600k. But this is only in case of quick payment.

  51. Message 051 From Victim Victim Date

    But we only have $255k. HOw are we supposed to get more money? It's very early morning here, everything is closed. I need to have this done before business hours. We were lucky the partner was still available and offered to help. We don't have any more options

  52. Message 052 From REvil Actor / other Date

    We cannot offer any other solution to the problem. We can wait there is no problem.

  53. Message 053 From REvil Actor / other Date

    We are ready to consider options for a deferred payment if you pay 300k now and receive a decryptor and 300k the next day for non-dissemination of your data.

  54. Message 054 From REvil Actor / other Date

    This is really the last thing we can offer

  55. Message 055 From Victim Victim Date

    If we wait any longer, we incur major risks

  56. Message 056 From Victim Victim Date

    I don't have $300k and then another

  57. Message 057 From REvil Actor / other Date

    Then we will not be able to agree

  58. Message 058 From Victim Victim Date

    This is really disappointing. We're making great strides to fix this with you

  59. Message 059 From REvil Actor / other Date

    We are ready to consider options for a deferred payment if you pay 255k now and receive a decryptor and 355k the next day for non-dissemination of your data.

  60. Message 060 From REvil Actor / other Date

    Its all!

  61. Message 061 From Victim Victim Date

    We can't!! How do I get $355k out of nowhere? We might be able to get a few more thousand dollars but definitely not $355k. I think the most we can actually send you is $284,811.29. THis is what we wired to the broker and he can purchase the crypto. His own fee is included in that amount but I think I can ask him to hold off on charging that so the full amount is yours okay? Please let me call him and ask this. It is only the afternoon where he is so it should be fast

  62. Message 062 From Victim Victim Date

    He agreed to help, which means the full amount we sent can go to you today. Please let me know!

  63. Message 063 From REvil Actor / other Date

    300 and okay

  64. Message 064 From REvil Actor / other Date

    price update you can pay.

  65. Message 065 From Victim Victim Date

    Thank you!! We will figure out the remaining amount, but I think this is possible. Thank you so much

  66. Message 066 From Victim Victim Date

    Can you unlock this? We don't have a picture to use

  67. Message 067 From REvil Actor / other Date

    file

  68. Message 068 From Victim Victim Date

    Thank you!!

  69. Message 069 From Victim Victim Date

    Can you confirm what we will receive today after we pay you $300k?

  70. Message 070 From Victim Victim Date

    Are you here?

  71. Message 071 From REvil Actor / other Date

    After payment you receive: - Universal decryptor for your all network - The complete deletion of all your files with our warranty not to use the data for any purpose. - 100% confidentiality of this incident and all terms of the transaction on our part. - Complete audit of your network to prevent similar attacks in the future

  72. Message 072 From Victim Victim Date

    Ok thank you for sending over this confirmation for me! I am working on sending payment, I will send you a confirmation here once it goes through. But I can only pay in bitcoin, where do I send it?

  73. Message 073 From Victim Victim Date

    Are you here? Please confirm where I should send the bitcoin.

  74. Message 074 From Victim Victim Date

    Are you here?

  75. Message 075 From REvil Actor / other Date

    You can use Bitcoin instead of Monero, but it will be more expensive for you in case of our merchant additional fee, so if u want to pay in BTC u need to add +10%. Or u can simply buy monero on this exchanges and withdraw on ur own wallet and send to us. https://www.okex.com/markets/spot?product=xmr_usdt https://www.binance.com/en/trade/XMR_BTC https://hitbtc.com/xmr-to-usdt https://www.hbg.com/en-us/exchange/xmr_usdt and there are all of the ways to get monero https://www.getmonero.org/community/merchants/#exchanges

  76. Message 076 From REvil Actor / other Date

    btc enabled update

  77. Message 077 From Victim Victim Date

    We can only pay in bitcoin because that's the only payment method the broker will help us with. We are giving you everything that we can to just reach $300k. We are ready to pay you quickly but we don't have an extra $30k to give you. Please, can we just pay the $300k that we agreed to in bitcoin so we can pay you quickly.

  78. Message 078 From REvil Actor / other Date

    10% commission is charged by our payment processor, we have nothing to do with this money. Below 300k we will not accept

  79. Message 079 From Victim Victim Date

    Are you ableto make the price $270k and then with the 10% it equals all of the $300k? We don't have another $30k. Some of us are going to max our credit card to get near the $300k you're asking. We really can't make another $30k happen and the broker in the US said its illegal to pay in monero, this is why it must be bticoins please

  80. Message 080 From REvil Actor / other Date

    There is nothing we can do to help. Our latest offer is 300k. If not, we will simply publish your details. We made maximum concessions

  81. Message 081 From Victim Victim Date

    Come on mate please help me out, we came this far. The broker said majority of the time you waive the 10%. I don't want to waste anymore of your time on this with me, let's just be done. I can't get any more money

  82. Message 082 From REvil Actor / other Date

    not interested.

  83. Message 083 From Victim Victim Date

    You're going to turn us away over 10%? What is this even for?

  84. Message 084 From REvil Actor / other Date

    After 12 hours, the amount will return to 1kk

  85. Message 085 From Victim Victim Date

    I need to know why you add the 10%, I can't just ask someone for $30k with no explanation

  86. Message 086 From REvil Actor / other Date

    I repeat bitcoin transactions are tracked and the payment gateway takes a commission to clear them

  87. Message 087 From Victim Victim Date

    They charge you 10% when you try to clear it? Or is it a small % and you are adding more? Can we agree on 3%?

  88. Message 088 From REvil Actor / other Date

    no

  89. Message 089 From Victim Victim Date

    You're killing me!!

  90. Message 090 From REvil Actor / other Date

    Our agreement 300k will not be lower

  91. Message 091 From Victim Victim Date

    We agree with $300k, but youre trying to add another $30k and we don't have any way to make that happen. We can only send you exactly $300k in bitcoin, you won't get less than this!

  92. Message 092 From REvil Actor / other Date

    Then pay in Monero 300k

  93. Message 093 From Victim Victim Date

    It's illegal!

  94. Message 094 From REvil Actor / other Date

    These are not our problems

  95. Message 095 From REvil Actor / other Date

    If you need decryptor pay.

  96. Message 096 From Victim Victim Date

    Why do you ask for payment in a currency the US can't pay?

  97. Message 097 From REvil Actor / other Date

    If you keep asking stupid questions, you will be banned from this chat. Either you pay, or we publish your data in the media with the subsequent sale, you must pass this information to your boss.

  98. Message 098 From Victim Victim Date

    He understands, we're trying to figure it out. There's no way to make the 10% lower?? Also he wants to know if you will let us download all the files you took from us after payment

  99. Message 099 From REvil Actor / other Date

    We provide a complete file tree for complete confidentiality after payment arrives at our account, the data is automatically deleted along with the server.

  100. Message 100 From Victim Victim Date

    Okay we 100% would like the file tree before you delete the files. But if there is any way we can download the files before you delete them, that would be preffered. Is that possible at all?

  101. Message 101 From REvil Actor / other Date

    No, this violates our privacy policy.

  102. Message 102 From REvil Actor / other Date

    Only file tree

  103. Message 103 From Victim Victim Date

    Okay thank you. Some people are just getting online now, so I will let you know soon on the payment

  104. Message 104 From REvil Actor / other Date

    OKay

  105. Message 105 From Victim Victim Date

    Can you lock the amount to be 6.0027 BTC so we can purchase the right amount without having to go back to our vendor multiple times?

  106. Message 106 From REvil Actor / other Date

    Ok

  107. Message 107 From Victim Victim Date

    Sorry our US broker hasn't been responsive, but I think that is because of the time zone. Can we still pay you in a few hours when they are online? I did not expect this to happen, but wanted to let you know that everything is set, I am just waiting on them

  108. Message 108 From REvil Actor / other Date

    No problem

  109. Message 109 From Victim Victim Date

    Thank you very much! I appreciate your help.

  110. Message 110 From Victim Victim Date

    we have paid

  111. Message 111 From REvil Actor / other Date

    Okay wait 3 confirmations

  112. Message 112 From Victim Victim Date

    Please send us universal decryptor now that there are 3 confirms. Thank you

  113. Message 113 From REvil Actor / other Date

    To use a decryptor run it as administrator and turn off antivirus before. You can use a decryptor as gui application or through cmd.

    CMD commands: UniversalDecryptor.exe -full UniversalDecryptor.exe -path "C:\folder" UniversalDecryptor.exe -file "C:\folder\file.txt.random_ext"

    * decryptor with -full option will decrypt all with default params.

    If you use it as gui application, mI recommend you choose "create backups" option. If you use decryptor without this option, you should not interrupt decryption process, otherwise some files will be irreversibly damaged.

  114. Message 114 From Victim Victim Date

    Thank you, please send us the file tree as well?

  115. Message 115 From REvil Actor / other Date

    file

  116. Message 116 From Victim Victim Date

    please confirm all files are deleted?

  117. Message 117 From Victim Victim Date

    Hi are you there?

  118. Message 118 From REvil Actor / other Date

    all files was deleted

  119. Message 119 From Victim Victim Date

    there is some issue and need your help

  120. Message 120 From Victim Victim Date

    ??

  121. Message 121 From REvil Actor / other Date

    ?.

  122. Message 122 From Victim Victim Date

    Can you please provide the invoice??

  123. Message 123 From REvil Actor / other Date

    We do not issue invoices

  124. Message 124 From Victim Victim Date

    any other method please??

  125. Message 125 From Victim Victim Date

    Please understand I will lost my job.. Higher management is asking for it.

  126. Message 126 From REvil Actor / other Date

    wait for answer.

  127. Message 127 From Victim Victim Date

    ok I am waiting Thanks

  128. Message 128 From Victim Victim Date

    Please help me fast please it's a humble request.. Higher management is keep pinging me & asking for it

  129. Message 129 From Victim Victim Date

    It's about my job please understand. I don't want to lose my job. I have my loans and debts which I have to pay. Please help me fast

  130. Message 130 From Victim Victim Date

    are you there???

  131. Message 131 From Victim Victim Date

    kindly reply me.. please understand my situation

  132. Message 132 From REvil Actor / other Date

    wait for answer