extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

REvil — 20210628

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 39 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
REvil
Record date
Jun 28, 2021
Messages
39
Participants
REvil, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    We take you seriously and we want to work something out but $50k is too much for us to get our computers back. COVID ruined our finances and we have entire lots of cars from last year sitting outside that no one is interested in because no one is driving anymore. Can we work out a reduction in the price?

  2. Message 002 From REvil Actor / other Date

    Hello, my boss can offer 20% discount

  3. Message 003 From Victim Victim Date

    Thanks for working with us. I'm not sure if that's going to be enough of a discount but I will talk with my boss and see what we can do. We see different names for the notes on each computer with different keys in them. Does the price include unlocking all of our computers?

  4. Message 004 From REvil Actor / other Date

    for all network

  5. Message 005 From Victim Victim Date

    Sorry we haven't reached out in a little while but we have been trying to figure all this out while keeping the business running. We want to make sure you are able to decrypt more than just one system. Can you decrypt these files to show you can?

  6. Message 006 From Victim Victim Date

    File 1

  7. Message 007 From Victim Victim Date

    File 2

  8. Message 008 From REvil Actor / other Date

    file

  9. Message 009 From REvil Actor / other Date

    file

  10. Message 010 From Victim Victim Date

    Pulling these down now. I talked to my boss and he said we can't pay in Monero do you accept Bitcoin?

  11. Message 011 From REvil Actor / other Date

    Of course, btc enabled

  12. Message 012 From Victim Victim Date

    Ok that's good to know. My boss wanted to see if you would be willing to let us pay $10,000 for the decryption. We know it's not what you are asking for but this is short notice and we are trying to do what we can to find available cash.

  13. Message 013 From REvil Actor / other Date

    not interested

  14. Message 014 From Victim Victim Date

    OK, my boss had someone willing to loan him some money if he needed to. Will you take $20,000? We could buy the Bitcoin and get you the money in 24 hours.

  15. Message 015 From REvil Actor / other Date

    25k and okay not lower

  16. Message 016 From REvil Actor / other Date

    price update

  17. Message 017 From Victim Victim Date

    OK, let me talk to my boss and get back to you.

  18. Message 018 From Victim Victim Date

    Just so I'm clear that payment would get us a decryptor for all our encrypted computers?

  19. Message 019 From REvil Actor / other Date

    of course

  20. Message 020 From Victim Victim Date

    OK we are working on getting the money together right now. Did you take any files from our computers? And how fast after we pay could we get the decryption software?

  21. Message 021 From REvil Actor / other Date

    few minutes

  22. Message 022 From Victim Victim Date

    OK thats good to know but my boss still wanted to know about whether or not you guys took our data before we sent the money.

  23. Message 023 From REvil Actor / other Date

    We took your data

  24. Message 024 From Victim Victim Date

    What did you take?

  25. Message 025 From REvil Actor / other Date

    It will take more than a month to analyze the data. If all you need is a data, leave this chat.

  26. Message 026 From Victim Victim Date

    We still want to move forward with payment for the decryptor we are just trying to understand what data was taken because it could impact our customers and we care about them. If you can give us a list of files it would help us a lot. Can you confirm that the bitcoin wallet is still [redacted]? Will you help us if something goes wrong with the decryption?

  27. Message 027 From Victim Victim Date

    We want to make payment today if you can confirm the wallet for us. We don't want to send it to the wrong place.

  28. Message 028 From REvil Actor / other Date

    [redacted] yes it is the right adress

  29. Message 029 From Victim Victim Date

    thanks for verifying.

  30. Message 030 From Victim Victim Date

    we are getting ready to make payment. Are you able to provide us a Dir listing of what you exfil'd?

  31. Message 031 From REvil Actor / other Date

    of course

  32. Message 032 From Victim Victim Date

    It took us longer yesterday than we thought to get the money together. We should be able to buy the bitcoin and send you payment today.

  33. Message 033 From REvil Actor / other Date

    ok we wait

  34. Message 034 From Victim Victim Date

    OK, it was difficult to get everything done on the weekend since the banks were closed most of the time but we should be making payment very soon. I just wanted to confirm that the price is still $25,000. The site shows 0.77 BTC which is $25,569 and there is a reference to Bitcoin (+10%). As long as we pay the agreed $25,000 you will decrypt all of our files on all computers right?

  35. Message 035 From Victim Victim Date

    OK, it was difficult to get everything done on the weekend since the banks were closed most of the time but we should be making payment very soon. I just wanted to confirm that the price is still $25,000. The site shows 0.77 BTC which is $25,569 and there is a reference to Bitcoin (+10%). As long as we pay the agreed $25,000 you will decrypt all of our files on all computers right?

  36. Message 036 From Victim Victim Date

    OK we sent the 0.77 Bitcoin, please confirm as soon as you get it.

  37. Message 037 From REvil Actor / other Date

    confirm

  38. Message 038 From REvil Actor / other Date

    yes for all network

  39. Message 039 From REvil Actor / other Date

    waiting 3 confirmations