Ransomware note
From extortion.wiki, the ransomware notes archive
- Family
- Nightspire
- Original file
- readme_2.txt
- Source snapshot
- 2bbf5b4ecda8
- Archive ID
- note-nightspire-readme-2-txt
A byte-attributed static rendering of the archived source text. Content is escaped, selectable, and inert; extortion.wiki does not execute markup, activate source URLs, submit forms, or load external resources from this document.
Archived note body
Plain text · original whitespace retained
Hi, Your hotel is hacked!
Your servers and files are locked and copied.
===================================
REMEMBER!
We also locked files in OneDrive.
And we did not change the extensions of files in OneDrive.
===================================
You cannot decrypt yourself without our key, even you're using third party software or from help of security companies.
Please do not waste your time.
Your files will be easily decrypted with pay. Never worry.
We're waiting here with UUID [snip]
Method * : nightspireteam.receiver@onionmail.org
Method 1 : Our qTox ID
3B61CFD6E12D789A439816E1DE08CFDA58D76EB0B26585AA34CDA617C41D5943CDD15DB0B7E6
Method 2 : Browse our Onion Site with Tor Browser
http://nspiremkiq44zcxjbgvab4mdedyh2pzj5kzbmvftcugq3mczx3dqogid.onion
http://a2lyiiaq4n74tlgz4fk3ft4akolapfrzk772dk24iq32cznjsmzpanqd.onion
We're waiting here with UUID [snip]
Related negotiation records
View all 7 recordsAn explicit alias maps the note family Nightspire to the Ransomchats actor label Nightspire. This relationship does not merge either corpus or its statistics.
| Record ID | Indexed date | Messages | Threat actor |
|---|---|---|---|
| 20260225 | Feb 25, 2026 | 48 | Nightspire |
| 20260217 | Feb 17, 2026 | 31 | Nightspire |
| 20260203 | Feb 03, 2026 | 45 | Nightspire |
| 20260127 | Jan 27, 2026 | 62 | Nightspire |
| 20251218 | Dec 18, 2025 | 84 | Nightspire |
| 20250428 | Apr 28, 2025 | 59 | Nightspire |
| 20250418 | Apr 18, 2025 | 38 | Nightspire |