It’s Not a Market: When Ransomware Negotiation Isn’t a Game
“You’re an incompetent negotiator.”
— REvil operator to a desperate victim
In the deep corners of the internet, where stolen data is currency and deadlines are weapons, a high-stakes game played out between a victim and one of the most notorious ransomware groups: REvil.
This post captures the tense and often surreal negotiation between the attacker and a corporate representative attempting to delay, reason, and beg their way out of a multimillion-dollar ransom. The chat log gives insight into the mindset of a ransomware operator and the impossible position victims find themselves in.
Price Shock
The conversation begins with confusion.
Victim: price is error?
Victim: how much btc?
REvil responds with cold precision. The price, reportedly in the range of $10 million in Monero, was not up for debate.
Attacker: Nope. You need to pay the requested amount of money. It is not a market.
The attacker insisted the amount had been "carefully calculated" based on the company's size and perceived worth. For the victim, it was their first time seeing the price. Their reaction: disbelief.
Victim: it's the first time i see the price , it's very exaggeration
Desperation and Delay
The victim’s strategy was textbook corporate: stall, escalate, and request proof. Their appeals shifted from incredulity to desperation, trying to buy time for internal decision-making.
Victim: I must have more bargaining chips to convince the boss
Victim: Excessive amounts must be paid by the Board of Directors, and it takes too much time
REvil wasn’t interested. Still, they extended a "goodwill gesture": a 20% discount if paid quickly.
But the victim needed more proof. They wanted something convincing—something destructive—to persuade higher-ups.
Victim: The more destructive the better
Proof of Breach
With the ransom price set and no room for negotiation, the victim shifts tactics: they start requesting proof. Not to verify the attack itself—they clearly believe it happened—but to gather enough alarming evidence to convince their leadership that this is a crisis worth escalating quickly.
Victim: Have any R&D information or personal information?
Victim: Can you give me some data?
Victim: The more destructive the better
It’s a desperate request, but a calculated one. The internal challenge for many corporate negotiators isn’t the threat—it’s buy-in from the top. As the victim explains later:
Victim: I must tell my boss this is serious
Victim: He didn’t realize the severity
REvil agrees to provide a small proof-of-breach sample. Rather than dump gigabytes of data, they offer a stripped-down file tree and a password-protected archive:
Attacker: We will give you an example of 1/10000 of your file tree
Attacker: Password: 123123
They insist this is enough to show their access was real and deep. Along with the files, the attacker delivers a warning—pointing to the SolarWinds breach as a cautionary tale, reminding the victim that the consequences of delay could be catastrophic.
Attacker: Tell your boss that it is very serious. The data received from your trusts is enough to deliver you problems for many years.
Attacker: Our advice, do not pull the time to not repeat the fate of the SolarWind.
Despite this, the victim continues to push for more. They need additional evidence to make the case internally.
Victim: I need more evidence, this is a global paralysis
But the attackers have no patience left. They consider the proof delivered, the threat made, and the clock ticking. For them, this isn’t a dialogue—it’s a countdown.
Breakdown
As the negotiation drags on, both sides grow increasingly frustrated—but for very different reasons. The victim is still scrambling for leverage, asking for more proof to convince their leadership that the threat is real and immediate. They’ve already received a file sample and a decryption password, but it’s not enough to sway internal decision-makers.
Victim: I must tell my boss this is serious
Victim: He didn’t realize the severity
REvil, meanwhile, interprets these delays as stalling tactics and a sign of weakness. Their tone shifts from transactional to aggressive, with threats escalating from vague warnings to specific consequences.
Attacker: If [a proposal] is not received tomorrow, Forbes and the WSJ will report a breach in your headquarters systems and all servers.
The victim tries once more to humanize the situation—highlighting that their own job, reputation, and internal standing are at stake.
Victim: What you need is money
Victim: What I need is my job and the trust of my boss
But empathy has no place in this dialogue. The attacker dismisses these concerns, bluntly suggesting that the victim is in over their head.
Attacker: So your boss has to get in touch with us himself. You're an incompetent negotiator.
This final insult marks the end of any meaningful negotiation. REvil is no longer open to discussion, compromise, or delay.
Attacker: Are we gonna talk about money? There will be no more dates, don't ask more about it.
The game is over. The victim never had real leverage—and in the eyes of the attacker, their time has run out.
Full Transcript
FULL TRANSCRIPT:
Victim: price is error ?
Victim: how much btc ?
Attacker: Hello.This amount was formed after a detailed audit of your company and
it fully corresponds to your level and size of your company.
The system works as follows: you transfer the amount in crypt currency Monero (XMR) to the wallet specified on your page.
After payment you receive:
- Universal decryptor for your all network
- 100% confidentiality of this incident and all terms of the transaction on our part.
Victim: Ten million ?
Victim: it's the first time i see the price , it's very exaggeration
Victim: what's is the lowest price ?
Attacker: wait for answer.
Attacker: Nope. You need to pay the requested amount of money. It is not a market.
Attacker: You pay for fullfill decryption your files and we tell you about your
vulnerabilities and how to fix them. Otherwise you will face new
different attacks, sooner or later it will lead to leaks of your and
your client's data and other valuable data again and again.
Attacker: We recommend that you transfer this information to the management.
We are ready for dialogue if you want to solve this problem.
We will not drag out negotiations.
We know the level of damage done to your network.
Also, our team received a large amount of important information that
will become publicly available if you do not pay or try to make too low
offers.
For our part, we are ready to provide a 20% discount if payment reaches us by Wednesday.This is our goodwill gesture.
Attacker: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/posts/[redacted]?s=[redacted]
Attacker: When the time expires, this post will be published.
Victim: maybe more discount ?
Victim: I must have more bargaining chips to convince the boss
Victim: Excessive amounts must be paid by the Board of Directors, and it takes too much time
Attacker: You can submit your proposal and my boss will review it.
The faster the payment arrives, the more discount we will give you.
As proof, we can provide any of your data.
Victim: Have any R&D information or personal information?
Attacker: The data provided should be sufficient to understand what we own.
We have been download personal information from 2015.
My boss is not ready to drag out this dialogue.
Make an offer and my boss will consider it.
Victim: Can you give me some data?
Victim: I will discuss with my boss
Victim: The more destructive the better
Victim: hello?
Attacker: wait for answer.
Attacker: We don't have time to download tens of gigabytes of information.
We will give you an example of 1/10000 of your file tree.
My boss is open to your suggestions, but we don't expect little money from you.
Attacker: File.
Victim: Decrypt password?
Victim: i need more file list
Victim: The more the better
Victim: I must tell my boss this is serious
Victim: He didn’t realize the severity
Attacker: Password: 123123
This is enough to understand that we have a lot of valuable information.
Tell your boss that it is very serious. The data received from your
trusts is enough to deliver you problems for many years.
Our advice, do not pull the time to not repeat the fate of the SolarWind.
Victim: I need more evidence, this is a global paralysis
Attacker: We have provided you with sample proof of what has been downloaded from your network.
You understand the seriousness of the situation for your company, and you need to explain this to your boss.
You are losing money every day.
Your time is running out, and very soon we will publish your data on the blog, it will bring you even more problems.
It is in your interests to quickly agree on the ransom amount and pay
quickly, and we will give you a discount. We are waiting for suggestions
from you.
Victim: I don't have enough chips
Victim: You have worked so hard, and the results are not far away
What I need is the trust and support of the boss
But if we talk no results, we can’t continue
Attacker: What results do you want to tell about? We've done enough to keep you in trouble for years to come.
Attacker: Now we are waiting for a clear proposal from you.
If it is not received tomorrow, Forbes and the WSJ will report a breach in your headquarters systems and all servers.
Victim: I am very actively trying to resolve this matter
But the data you gave me didn’t allow me to convince my boss
Attacker: Then we'll do it.
Victim: What you need is money
What I need is my job and the trust of my boss
But you don't give me a bargaining chip to talk to my boss
I'm really in difficulty like this
Attacker: So your boss has to get in touch with us himself. You're an incompetent negotiator.
Victim: ....
Attacker: Are we gonna talk about money? There will be no more dates, don't ask more about it.Closing Thoughts
This exchange reveals the stark imbalance in ransomware negotiations. For REvil, it's business: demands, deadlines, and threats—all delivered with clinical coldness. For the victim, it's chaos, career risk, and desperation.
The victim pleads for time, proof, and leverage. The attacker responds with pressure and insults. At one point, the victim says:
"What you need is money. What I need is my job and the trust of my boss."
But there's no room for empathy in extortion. Trust breaks down quickly, and once it does, the conversation shifts from negotiation to ultimatum.
By the end, it’s clear: ransomware isn’t just about data—it’s about power, and once the attacker has it, there are no fair terms.