The Message in the Negotiation Window
A ransom negotiation message quoted in a federal advisory gets straight to the point. The attackers told their victim they had noticed the company “has stocks,” and that if it did not engage them, they would leak the data to “the Nasdaq” and see what happened to the share price. The message survives because the Bureau judged it worth quoting, not because anyone behind it has ever been identified.
The Notice Itself
The quote comes from FBI Private Industry Notification 20211101-001, dated November 1, 2021, issued by the Bureau’s Cyber Division and coordinated with the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA). It carries a Traffic Light Protocol marking of TLP:WHITE, meaning the Bureau cleared it for open, unrestricted distribution from the day it was written.
The National Security Archive, a nongovernmental research institute based at George Washington University that collects documents obtained through the Freedom of Information Act, catalogued the notice the same day it was released, as part of its Cyber Vault Library. There was no gap between publication and archival capture.
The notice cites three other materials without reproducing them: a joint technical advisory from Australia, Canada, New Zealand, the United Kingdom, and the United States on uncovering and remediating malicious network activity; a Joint Ransomware Guide produced with the Multi-State Information Sharing and Analysis Center; and a November 2020 technical writeup on a remote access trojan called Pyxie RAT. None of the three is attached. The notice assumes a reader who already has them.
The Pattern the Notice Describes
What the document lays out is a sequence, not a single case. In early 2020, a user posting under the moniker “Unknown” wrote on the Russian-language forum Exploit, suggesting that a victim’s listing on the Nasdaq exchange could be used to pressure it into paying. In March 2020, during an active ransomware negotiation, the attackers delivered the message quoted above. Between March and July 2020, the notice states that at least three publicly traded U.S. companies were hit by ransomware while in the middle of merger and acquisition talks; two of the three deals were still private at the time.
In November 2020, a technical analysis of Pyxie RAT, which the notice describes as often preceding Defray777 or RansomEXX ransomware infections, found that the trojan had been configured to search infected networks for specific terms: 10-Q and 10-SB filing codes, N-CSR, NASDAQ, Marketwired, and Newswire. In April 2021, the Darkside ransomware group posted a message on its own blog offering to share leaked data before publication so a buyer could profit from the resulting drop in a victim’s share price if the victim refused to pay.
What the FBI Actually Concluded
The notice’s operative sentence is phrased as a probability judgment, not a case finding: the FBI assesses it is “very likely” that ransomware actors use significant financial events and stock valuation data to select targets and to raise the pressure to pay. That is an assessment built from the pattern above, not an attribution to any named individual or group beyond the monikers already on the record.
The notice does not claim to have solved a case. It recommends defensive measures, including offline backups, two-factor authentication through an authenticator app, and least-privilege network permissions, and it states plainly that the Bureau does not encourage paying a ransom, since payment does not guarantee data recovery and may encourage further attacks.
The Colonial Pipeline Footnote
One footnote stands apart from the rest of the document in how certain it sounds. It states, without hedging, that Darkside ransomware was the variant used in the Colonial Pipeline intrusion in May 2021. Everywhere else in the notice, the financial-targeting pattern is described as “very likely.” Here there is no qualifier at all.
The footnote does not tie Colonial Pipeline back to the stock-leverage pattern the rest of the notice describes. The lever in that intrusion was fuel supply, not merger timing or a ticker symbol. It reads like a fact added for context about who Darkside is, not an extension of the financial-targeting argument the notice is otherwise making.
What the Notice Does Not Say
Four things are absent from the document, and the absence is worth naming rather than filling in. The three publicly traded companies hit during merger negotiations in 2020 are never identified. The forum poster known as “Unknown” has no identity beyond that handle. No outcome is confirmed for any of the 2020 incidents: whether a ransom was paid, whether a stock price actually moved, is not stated either way. And the notice never explains how the “very likely” rating was reached, how many incidents were reviewed, or what evidence threshold the Bureau applied to call it likely rather than merely possible.
Why This One Traveled
A TLP:WHITE marking exists so a document can move freely, and this one has. It was written for security teams and corporate risk officers, not for a general readership, and it never promised a solved case. What keeps it circulating is the shape of the assessment itself: a forum post, a negotiation threat, a trojan’s keyword list, a blog ad offering to help someone short a stock, all pointed at the same conclusion without a single name attached to any of it. The file does not resolve that. It was never built to.
—
**Summary of fixes made:**
1. Capitalization: “the nasdaq” → “the Nasdaq” (two instances, proper noun); “NASDAQ” in the Pyxie RAT keyword list left as-is since it represents a literal search term/filing code, not a general reference to the exchange.
2. No subject–verb agreement errors found.
3. No article (a/an/the) errors found.
4. No verb tense inconsistencies found.
5. No pronoun/homophone errors found.
6. No spelling inconsistencies found (American spelling used consistently).
7. No punctuation errors found (quotation marks, apostrophes, and commas are consistent).
8. No relative-to-today date references found; all dates are already absolute (e.g., “November 1, 2021,” “early 2020,” “May 2021”).