Four Prices, No Counteroffer: The Ransomware Victim Who Never Named a Number

A 27-day ransomware negotiation in which the price fell from 15 BTC to $1,000,000, the deadline was extended seven times, and the victim never put a single figure on the table.

Most ransomware negotiations follow a familiar choreography. The attacker anchors high, the victim counters low, and the two sides trade numbers until they meet somewhere in the middle, or until someone walks away. The counteroffer is the basic unit of the exchange.

This transcript has none. Over 27 days and 55 messages, the victim never once proposed an amount. They said thank you. They said leadership needed time. They said the bank meeting was on Monday and the Chairman was overseas. And the attacker, negotiating against nobody, cut their own price three times: from 15 Bitcoin, to $1.2 million, to $1.05 million, to $1 million.

Then the victim went quiet, and the attacker posted a countdown.

The Opening: A Price Tag and a Product Catalogue

The victim opens the chat, and the first thing they ask for is channel control:

"You have our attention now and are following your instructions. Please confirm you will communicate with us only on here."

The gang confirms in two words, then gets to work. Within an hour they send the file tree of everything they stole and a link to a file-sharing download. They offer the standard trust-building package: the victim may pick three files from the tree as proof of theft and decrypt three files for free as proof of decryption.

Overnight, a long scripted message arrives that reads like a sales sheet. It explains the process step by step and then states the price:

"The price set by our team for [the company] is "15 Bitcoins". After payment is made, you will receive : Universal Decryptor for all the locked machines ( WINDOWS - ESXI - NAS and so on ) Proof of deletion of your files from our servers A write up on how this incident happened ( The initial access, encryption and exfiltration process ) Guarantee that [the group] will never target you again."

Four deliverables are bundled into one price. That bundle becomes important later, when the victim tries to unbundle it.

The victim's next substantive message, four days later, contains the most interesting line in the opening phase:

"Please confirm you will stop calling and emailing our employees directly or we won't be able to continue this discussion. You have our attention, but no one else is authorized to talk to you."

The chat does not show the calls or emails themselves. The request implies that the gang had been contacting staff outside the portal before the victim came to the table. The attacker agrees ("yes we conform to only talk through here but you have to cooperate") and sends the three requested proof files: an internal approval document, a numbered PDF, and a quarterly logistics fee spreadsheet.

The Middle: Proof, Politeness, and a Timer That Kept Growing

What follows is two weeks of slow, courteous process. The victim cites internal approvals and "the holiday weekend". The gang sends patient check-ins ("No worries, We'll be waiting for you") and holiday greetings. Test files finally go up ten days in, and two come back decrypted the next morning. The third file did not come through (the gang says test uploads are capped at 4MB), so a replacement is decrypted the day after. Each delay also buys the victim time.

The tone on the attacker's side is the striking part. The gang rewards cooperation with extra time, again and again:

"Decrypted files sent, we've also added 1 day to your timer since we were away yesterday as a token of appreciation for your cooperation."

When the victim replies after U.S. business hours, the attacker sounds less like an extortionist and more like an annoyed vendor:

"...I kindly ask you to select another file and not wait until after working hours in the future days because just like you, we have work hours as well and we won't be working overtime everyday to make sure we catch you being online."

The victim answers with almost exaggerated warmth ("I completely understand you have your own schedule and priorities... Thank you so much for your patience and assistance"), and the attacker adds two more days. Before long, the gang is reassuring the victim that payment can safely happen over a weekend, because the decryptor handover and the data deletion are "both automated" and will trigger "the second the payment gets confirmed on the blockchain."

The Turn: "We Don't Have That Kind of Cash on Hand"

Two weeks in, the victim finally addresses the price. They still don't make an offer:

"While we understand that your original payment ask was 15 BTC, we currently don't have that kind of cash on hand to reach that number. Would you be willing to work with us on the pricing?... We have a meeting with our bank on Monday to see what funds we are approved for. Could you please extend the timer to the end of next week..."

The message has no number, no counteroffer, and no budget ceiling. It contains a claim of illiquidity, a dated external dependency (the bank), and a request for time. Forty-five minutes later, the gang answers with a price cut, a justification, and a reveal about how they price victims:

"...we can have a deal on 1,200,000 USD fixed rate. that's around 11% discount for your case. We've already given you a lower initial price than normal, ( Normal cases would be around 1.8M - 2M in your revenue range with insurance and etc ) so further discounts will not be happening... We expect your mother company and your insurance chipping in for your lack of cash..."

Three things are worth noting here. The attacker converts the demand from BTC to a fixed dollar amount. They say plainly that they price by revenue band and assume a cyber-insurance policy. And they declare the $1.2M figure final, which it was not.

The Unbundling Attempt and Two More Discounts

The victim thanks them a few days later and goes back to internal discussions. Two days after that, the gang pushes for agreement on the price "TODAY", then adds another day to the timer unprompted. The next day the victim tries something new: they ask to buy only part of the package.

"...we are having difficulties getting bank authorization for the full amount of 1.2 million by the end of the week... To move things along faster, we could focus instead on getting approval for one of your services instead. Could you please share the pricing for each service?"

The attacker refuses to unbundle, then drops the price anyway, four minutes later:

"We don't do "each service"... that being said, I've talked to our team and dropped your price to 1,050,000 USD a sign of good will to close this out in before Christmas for you."

The next day the victim plays its last delay card. The key decision-makers are abroad:

"...our Chairman and President, who are key decision-makers, are currently overseas for an executive meeting and aren't reachable right now. Since they won't return to the U.S. until Monday, we'll need a bit more time... We’ll update you by Tuesday after we’ve had a chance to go over everything with them."

Within an hour, the price falls again:

"We understand your situation. I've dropped your price to 1,000,000 USD. from this point our windows for discounts are super tight. I've also increased the time till Thursday this week."

This is the victim's last message in the transcript.

The End: The Private Post

The promised Tuesday update never appears in the chat. Four days later, the gang sends a polite nudge and, once again, adds a day to the timer. Two days after that, the tone finally changes. The attacker sends a link to a leak-site post bearing the chat's own ID, followed by:

"In case you think we aren't serious, this post is currently PRIVATE, in 24 hours it'll be visible for public and in 24 hour after that EVERYTHING will be published. If we didn't give you the extra 1 day you'd be published today."

The transcript ends there. It records no payment, no decryptor delivery, and no proof of deletion. Whether the company paid later, through another channel, or let the data go, the chat does not say.

What This Transcript Teaches

You do not have to name a number to move one. The victim's only financial statement was that they lacked the cash. Every concession, about $380,000 off the dollar value of the original demand at the time,* came from the attacker reacting to delay, illiquidity, and absent decision-makers. A first counteroffer sets a floor the attacker can work up from. This victim never gave them one.

Attackers price by revenue band and assume insurance. The gang says it outright: "Normal cases would be around 1.8M - 2M in your revenue range with insurance." It also expects the parent company to help pay. Defenders should assume the attacker has read the financial files in the stolen data and knows the corporate structure and the coverage before the chat begins.

"Final" is a negotiating word. The $1.2M figure came with "further discounts will not be happening". Six days later the price was $1.0M. Declarations of finality in this chat were tactics, not floors.

The Discount That Cost Nothing

In 27 days the price came down by roughly a quarter. The victim never risked a lowball, never cited a budget it would later have to exceed, and never gave a figure to anchor against. They made the attacker negotiate with a clock and an empty chair. It worked until the moment it stopped working: the victim fell silent after promising an update, and the gang reached for the countdown.

For negotiators, the lesson is not that silence wins. Patience with a reason attached gets results. Patience without one gets a leak-site post.