A 16-day ransomware negotiation in which the victim won four timer extensions with a board meeting, the Easter weekend and a slow finance team, never made an offer, and watched a 2,500,000 demand hold until the leak-site upload began.

Most ransomware negotiation write-ups are about the discount: how far the attacker came down, and what moved them. This one is about a price that never moved at all.

Over 16 days and 79 messages, one victim used almost every delay a negotiator can reach for. They tested the chat, reviewed the file listing, asked for proof files, sent files for test decryption, cited the Easter weekend, a Friday board meeting, and a finance team that was still "working through their review process". They asked why the price was so high and how anyone could trust the people demanding it. They earned four timer extensions.

What they never did was name a number. The attackers asked for one three times. The demand of 2,500,000 stood unchanged from the first time it appeared in the chat to the last message, in which the attacker announced it was uploading the victim's data to its leak site.

The Opening: A New Chat, Because the Old One Was Compromised

The transcript starts in the middle of something. Its first message is the victim's:

"Hello, we are testing the new chat"

The victim's next request is about the channel itself:

"Can you please ensure the old chat is locked or wiped so there is no further communication there?"

A day later, asking for more time, the victim explains why:

"...Since we lost some time getting set up in the new chat after the unauthorized access, is there any flexibility on the timer so we have a fair chance to finish our internal review?"

The chat never says who got into the old one. Negotiation portals are typically reached with a link and key left in the ransom note, so anyone who obtains the note can join the conversation (inferred; this is general background, not something the chat explains). Whatever happened, it means this transcript is not the whole negotiation. The demand, and whatever was said about it, came before the chat begins (inferred): the victim later asks about "your price" as something already known, and the figure of 2,500,000 first appears only on day seven.

The gang, for its part, is brisk. Within minutes it asks whether the victim downloaded the file listing of stolen data, and later that afternoon it offers the standard proof package:

"you can choose 3 random not important files from that listing and we send them to you as a proof"

The Middle: Proof, Patience and the Easter Weekend

The victim takes a day to choose, then asks for three files: a lease checklist, an invoice and an inventory reconciliation spreadsheet. The gang's first upload is an empty archive ("files.7z (0 bytes)"); a 2 MB archive follows a few seconds later, with "Here you go". The victim asks for flexibility on the timer and gets it in one line:

"timer extend until Tuesday"

The same evening, the gang sets out what it expects in return:

"Just let you know we need an offer from you at the end of the week"

It also offers to decrypt one "not important small file" for free. The victim sends two, with a revealing caveat:

"Okay, I have two locked files. I have no idea what files they are, but are from a folder that shouldn't have anything important..."

The files come back decrypted the following morning. They are named "Asset Distribution.pdf" and "BS Consolidation.xls". The folder that "shouldn't have anything important" held what look like financial records, and the victim had just handed the attacker readable copies (inferred from the file names; the chat does not show their contents). The gang asks if the files checked out. The victim answers with the first of its calendar-based delays:

"Just got the files over to our team earlier today. With it being Friday afternoon and the Easter weekend coming up, a few key people are already offline. We likely won’t have full feedback until Monday..."

No offer arrives that week. The gang lets it go and replies: "Okay, we are here waiting".

The Turn: "Why Is Your Price So High?"

On Monday, the victim finally raises the money, as a question rather than a figure:

"Are you able to explain why your price is so high? What exactly led you to think we could ever afford to pay this much? There must be a misunderstanding and I think it's important to clear it up so we can discuss this."

Nine minutes later the demand appears in the chat for the first time:

"We don't conclude the amount from our heads, we calculate your estimated recovery costs, your revenues, and the costs of not recovering your systems. The price of 2,500,000 is fair enough, but we are here to negotiate, so we are willing to consider your reasonable offers."

The attacker never says which currency. US dollars is the natural reading, but that is our inference. Pressed on how the figure was chosen, the gang describes an internal process and points to the clock:

"We have a separate department of data analysis, from there we get the amount with which we start a dialog, that's all I can tell you at the moment. I would also like to draw your attention to the timer, if it runs out I will not be able to help you."

"we want to make a deal with you, and we give you a choice, to lose a lot by rejecting us, or to give a little and restore your work in the old way, preserving the important thing you have, namely your reputation."

The phrase "the amount with which we start a dialog" is the attacker admitting that 2,500,000 is an opening position. The victim does not test it. Instead it announces a board meeting on Friday, and the timer moves again: "timer extend until friday".

The Trust Questions

With the clock reset, the victim spends two days on questions about reliability, framed as material for the board:

"How could someone in our position trust you? Can you share any facts or figures to support your reliability? "

The gang's answer is a shrug with a rhetorical flourish:

"And what other choice do you have, we've already shown you A that we have files, B we've shown you that we can decrypt encrypted files. This already proves the fact that we can help you, and now the question for you is from a business point of view, does it make sense for us to deceive you in any form? This is a rhetorical question."

When the victim politely asks again for "examples or data points", the reply is pure marketing:

"We are synonymous with the word reliability, otherwise you would have found negative reviews about us a long time ago, we have been in business for over 2 years and have helped over hundreds of companies to recovery their documents..."

"Information about our reliability can be found in 2 places, A - google.com and B - at recovery companies that keep statistics (I strongly advise you not to spend money on them)."

The second message is a rare moment of candour. The "recovery companies that keep statistics" are, presumably, incident-response and negotiation firms (inferred), and the attacker is telling the victim not to hire one.

The Board Meeting That Bought a Weekend

On Thursday, the victim reports "progress with our internal discussions" and asks for the timer to run until Monday. It is granted four minutes later. Then the victim notices a detail most people miss:

"Just a heads up, the timer is set to expire in the early hours of Monday morning, but as the team won't be online yet at that time, we'll need to ask for a brief extension until later in the day when we can resume discussions..."

The gang replies "timer updated" and signs off with "Waiting good news tomorrow". That was the fourth extension, and the last.

Friday's board meeting comes and goes without a message in the chat. On Monday the gang asks "Any news?". Nine hours later, the victim's answer is the first message in the chat that sounds like bad news:

"...After the board meeting, we've had to talk to our finance team, and there’s been some back-and-forth on their side, especially with the demand as high as it is. It's slowed things down more than we expected. We’re still moving forward, just at a slower pace than any of us would like..."

For the first time, the delay has no date attached. The attacker notices at once:

"How much time do you need?"

The victim cannot say. The gang makes its third and most direct invitation:

"give us an offer from your side and maybe we can come to an agreement"

The victim's reply is its last message in the transcript:

"I understand. The challenge is that we still don't have final internal approval to even discuss numbers yet, finance is still working through their review process. Once I have more direction, I’ll be able to update you."

The End: "No More Time Will Be Added"

The gang replies "okay". The next day it asks "Any news?" again and gets no answer. Two days after that come the last two messages in the transcript:

"Since you ignoring us we starting upload your data to our blog"

"no more time will be added"

The chat ends there. It records no counteroffer, no payment, no decryptor and no proof of deletion. Whether the company paid later, through another channel, or let the data go, the transcript does not say.

What This Transcript Teaches

Stalling without a number has a shelf life. The victim never named a figure, and neither did another victim of the same gang, in a separate chat, who talked the price down from 15 BTC to $1 million without one. Here the same approach produced 16 days and four extensions, but no reduction at all. The attacker asked for an offer three times. With nothing on the table, it had nothing to respond to, and when the delays ran out it went to the leak site rather than to a lower price.

Dated delays buy time; open-ended ones end it. The Easter weekend, the board meeting on Friday and the Monday morning timer each came with a date, and each was granted. The first delay with no date ("it’s hard to give an exact timeframe") got "How much time do you need?", then a demand for an offer, then, after an unanswered check-in, the upload notice.

Your test files are a data sample too. The victim sent two files from a folder it believed held nothing important. They decrypted as an asset distribution PDF and a balance-sheet consolidation spreadsheet. Before sending files for a test decryption, check what they are, and pick files whose contents are genuinely worthless to an attacker.

Guard the channel. This negotiation had to move to a new chat after what the victim called "unauthorized access" to the old one, and the move cost time on the clock. Treat the ransom note's portal link and key as secrets, limit who has them, and agree with the attacker early that only the one channel counts.

A Price That Didn't Move

The company bought itself 16 days with patience, courtesy and a calendar full of reasons. It got proof of theft, proof of decryption and four extensions. It did not get a discount, because it never gave the attacker anything to discount against, and its last message ("Once I have more direction, I’ll be able to update you") was followed by silence.