Ransomware.live 👀

[redacted]: Help?

12/30/2020, 2:34:05 PM

Support: Hello

12/30/2020, 2:56:23 PM

Support: Are you ready to negotiate?

12/30/2020, 2:57:23 PM

Support: As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website https://continews.best/ (TOR mirror: http://fylszpcqfel7joif.onion). The recovery price is $8500000 (302.5 BTC). This initial offer is based on the details about your revenue and internal financial documents we currently have access to. If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published, all the backdoors will be removed from your network and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch.

12/30/2020, 3:07:43 PM

[redacted]: That's a crazy price. How do we even know if this will work?

12/30/2020, 3:14:33 PM

Support: You can send 2 files for decrypt. Its free.

12/30/2020, 3:15:25 PM

Support: In addition, we have stolen more than 1 terabyte of information from your network.

12/30/2020, 3:17:52 PM

[redacted]: We have a lot of questions. Maybe you've got the wrong price because we have no idea what internal financial documents show that we can pay $8,500,000.

12/30/2020, 3:21:06 PM

Support: Hours and Revenue analysis November 2020 YTD (2).xlsx [ 52kB ]

12/30/2020, 3:31:45 PM

[redacted]: I'm not in finance but those look like revenue numbers, not profits. Can you share the files you've taken so that our team can verify?

12/30/2020, 3:35:55 PM

Support: Yes. Please wait.

12/30/2020, 3:37:42 PM

[redacted]: Thanks. I should have 2 files for you shortly.

12/30/2020, 3:38:06 PM

Support: list_firstpart.zip [ 5MB ]

12/30/2020, 3:44:47 PM

[redacted]: What's this?

12/30/2020, 3:51:40 PM

Support: Listing of the first part of the stolen information

12/30/2020, 3:52:15 PM

[redacted]: Will we get more parts later?

12/30/2020, 3:58:55 PM

Support: Yes, we are unpacking a terabyte. It will take a lot of time. You can select any file from the listing and we will discard it as proof that we have these files.

12/30/2020, 4:00:24 PM

[redacted]: Ok please let us know once it has been unpacked. It will be important to get the full listing

12/30/2020, 4:06:27 PM

[redacted]: [redacted]-EMEA.xml.[redacted] [ 3kB ]

12/30/2020, 4:06:47 PM

[redacted]: Can you decrypt this?

12/30/2020, 4:07:10 PM

Support: I have sent your file to the technical department. Wait.

12/30/2020, 4:08:50 PM

Support: [redacted]-EMEA.xml [ 2kB ]

12/30/2020, 6:00:58 PM

[redacted]: We're going to review all these files.Any update on the 1 TB?

12/30/2020, 11:20:05 PM

Support: Will upload the file listing as soon as it's ready.

12/31/2020, 1:33:54 AM

[redacted]: Ok we'll be here. Thanks

12/31/2020, 2:01:24 PM

Support: 25 % ready. This is a very slow process. Wait.

12/31/2020, 2:29:43 PM

Support: It will take a few days

12/31/2020, 2:30:23 PM

Support: You can choose ANY file from the listing above and we will discard it as proof

12/31/2020, 2:31:01 PM

[redacted]: We'll work on that. Offices are closed the next few days but we'll be in touch. Ok?

12/31/2020, 9:23:03 PM

[redacted]: This is our priority

12/31/2020, 9:23:11 PM

Support: Ok, just keep us updated on your progress.

12/31/2020, 9:30:38 PM

Support: 50% Ready

1/1/2021, 2:20:17 PM

Support: 70% Ready

1/2/2021, 10:40:13 AM

[redacted]: Thanks. We're still here

1/2/2021, 1:36:54 PM

[redacted]: While you're pulling the file tree, can you send us this file? 05/07/2020 02:55 PM 106,393 [redacted] - Draft 2020 05 06 v2.docx

1/2/2021, 4:06:21 PM

Support: Yes, will upload soon

1/2/2021, 5:08:27 PM

Support: [redacted]---draft-2020-05-06-v2.docx [ 104kB ]

1/2/2021, 6:43:36 PM

Support: %90 ready

1/3/2021, 6:25:38 AM

[redacted]: Thanks, still here and checking in.

1/3/2021, 4:38:25 PM

Support: 100% ready. Wait listing

1/3/2021, 5:18:45 PM

Support: listing_1tb.zip [ 9.2MB ]

1/3/2021, 5:24:33 PM

Support: You can choose ANY file from the listing above and we will discard it as proof

1/3/2021, 5:25:13 PM

[redacted]: Thanks. So this is a directory of every single file you've taken from our network?

1/4/2021, 1:36:29 PM

Support: yes

1/4/2021, 2:21:52 PM

Support: total of data more 1tb

1/4/2021, 2:22:42 PM

Support: so, what other questions do you have?

1/4/2021, 2:29:38 PM

[redacted]: Thanks. We are looking now

1/4/2021, 4:21:12 PM

Support: so ?

1/4/2021, 7:25:14 PM

[redacted]: This is a lot of data to review. How did you get these files off our network?

1/4/2021, 10:12:32 PM

Support: Packing data into an archive provides compression up to 95%

1/4/2021, 10:16:59 PM

Support: After the deal is concluded, we will give recommendations on how to prevent this.

1/4/2021, 10:18:35 PM

Support: I propose to return to the discussion of the agreement

1/4/2021, 10:19:03 PM

Support: After the conclusion of the agreement, we overwrite the data

1/4/2021, 10:27:23 PM

[redacted]: Yes, we want to discuss the agreement. $8,500,000 is a lot of money. We're just trying to see all the details because that is still an unexpected amount.

1/4/2021, 10:46:43 PM

[redacted]: Even if we had that much money, how do we know you won't just take the money and resell the data?

1/4/2021, 10:47:05 PM

Support: We will show the cleaning logs

1/4/2021, 10:49:20 PM

Support: This price is indicated for restoring ALL data in your network and deleting data on our servers

1/4/2021, 10:53:38 PM

Support: We will give a decryptor and you will restore all the work

1/4/2021, 10:54:46 PM

Support: We value our reputation and never leak any data after the deal is closed

1/5/2021, 6:39:28 AM

[redacted]: Alright, so we are thinking this through now. I will get back to you soon, alright?

1/5/2021, 7:45:42 AM

Support: Ok, waiting.

1/5/2021, 7:46:25 AM

[redacted]: We're trying to get answers on our end. Thanks for waiting

1/5/2021, 7:06:47 PM

Support: Ok waiting

1/5/2021, 7:10:31 PM

Support: If you have any questions - we can help you But the sooner you conclude an agreement, the sooner you will resume work and will no longer suffer losses due to this situation.

1/5/2021, 7:11:51 PM

[redacted]: Can you send this file? 08/03/2020 05:14 PM 13,697 [redacted]_v4 CL.docx

1/5/2021, 7:40:18 PM

Support: Yes Wait

1/5/2021, 7:41:36 PM

Support: [redacted]_v4-cl.docx [ 13kB ]

1/5/2021, 7:42:23 PM

[redacted]: Thanks for the quick response

1/5/2021, 7:47:36 PM

Support: Are you convinced? There is really a lot of your data here

1/5/2021, 7:48:00 PM

[redacted]: We certainly see that you have our data. Nothing to hide there

1/5/2021, 7:53:54 PM

[redacted]: It's the price that's causing us heartburn...

1/5/2021, 7:54:11 PM

Support: Publishing data will cause customer churn and you will lose much more. It is more profitable to work with us

1/5/2021, 7:57:28 PM

[redacted]: Yes, but how do we pay if we don't have the cash?

1/5/2021, 10:02:26 PM

Support: There are plenty of ways to get the cash, like insurance or a corporate loan.

1/6/2021, 7:48:31 AM

[redacted]: If those were option we would have pulled those levers already!

1/6/2021, 7:53:21 AM

Support: We are ready to hear your proposal which is based on your abilities, but it should be relevant to the initial offer.

1/6/2021, 7:58:29 AM

[redacted]: We are treating this as a data leak, no matter what. However, there is some upside to getting the files deleted (even though there are no assurances). Millions of dollars is excessive for this type of data and we don't have much need for a decryptor. Our proposal is $250,000.

1/6/2021, 7:22:39 PM

Support: That is way lower than your abilities and not as relevant to our expectations as we thought. Although I will pas your offer to my boss and get back to you.

1/6/2021, 7:48:08 PM

[redacted]: Sounds good. Thanks.

1/7/2021, 7:46:05 AM

Support: We've discussed internally, and taking in consideration the facts that you are trying to work this through and the fact that you don't need the decryption tool I've managed to convince my boss to provide you the huge discount by going down to $2125000 (70% discount). If we close the deal this way we have to intention to sell or publish your data of course.

1/7/2021, 8:55:46 AM

[redacted]: We are still far apart but we view this is a positive step. Thank you.

1/7/2021, 7:41:23 PM

[redacted]: Can we discuss with our team?

1/7/2021, 7:41:34 PM

Support: yes

1/7/2021, 7:41:54 PM

[redacted]: This reduction is interesting. It's almost end of week here and some of our management wants to discuss. Can we reach out next week?

1/8/2021, 1:41:55 PM

Support: Yes, sure, let's get back to this on Monday. Just keep us updated on the progress.

1/8/2021, 1:46:38 PM

[redacted]: Ok

1/8/2021, 7:53:02 PM

[redacted]: We're connecting on this topic later today and tomorrow morning. We may be able to increase the dollar amount.

1/11/2021, 6:15:35 PM

Support: Ok, will be waiting for further details

1/12/2021, 8:45:38 AM

[redacted]: We have reviewed the data and while the files contain company information, they will not cause millions in damage. Even if they did, we'd have to live with that because we are on a tight budget in 2021. However, we think there is some value with your cooperation and we're prepared to pay $400,000 immediately. We can work out the details if you want to make a profit. Otherwise, we may be out of opportunities.

1/12/2021, 10:32:48 PM

Support: We will discuss internally and get back to you soon.

1/12/2021, 11:38:56 PM

[redacted]: great, ok thank you.

1/13/2021, 8:13:13 AM

Support: We've discussed, despite the fact that my boss considers our last offer reasonable I managed to convince him to review it. He agreed to go down to $600k if the deal will be closed by the end of this week. Once the transfer is made you will be provided with security recommendations on network improvement, breach details, all you files will be completely wiped from our servers once and for all. Also we can upload your files to mega.nz secure share and provide you with full access to it. That's a fair offer and I did everything possible to make it work. Hope you appreciate.

1/13/2021, 10:58:09 AM

[redacted]: We do appreciate that but we'll need to discuss since it's more money than what we have at the moment. Before we discuss, can you also confirm that we would receive a decryption tool in addition to the above deliverables?

1/13/2021, 6:24:56 PM

Support: As I remember you do not need a decryption tool. Am I mistaken? Most of the discount was provided based on the fact that you do not need the decryption.

1/13/2021, 8:08:47 PM

[redacted]: There are some files that would save us time. $400,000 is not a small amount.

1/13/2021, 8:16:03 PM

Support: That is way below our offer. Yes, surely the decryptor would save you some time, and time means money. The $600k offer was for the data we hold. As you must understand we have some experience in negotiations, and you are trying to put us in the position that you think we accept, based on the basic information that is in the the press about usual sum we get. Relying on the press or public opinion is a mistake. About 75% of our deals are never leaked to the public or revealed. We will be waiting for your decision by tomorrow. $600k for the files or something better for full pack.

1/13/2021, 8:27:04 PM

[redacted]: Yes, we know you are very experienced. We can sense it. All we're doing is seeing how much money we can spend, and $400,000 is an large sum. If we go down this path, then we certainly want all of the items that are available.

1/13/2021, 10:28:14 PM

[redacted]: We've read about you in the press but we have no idea about the usual sum that you get. No one here wants to play games, and that's why we're trying to finalize the deliverables in advance. We want a solution and we assume you want to get paid. But $400,000 is only available if we can get everything. How else can we afford to pay that much?

1/13/2021, 10:30:33 PM

Support: The $400k is too low anyways. I will talk to my boss and try to get an offer for $600k that will contain the decryptor. Give me few hours.

1/14/2021, 5:24:58 AM

[redacted]: Alright - your best offer that includes the decryptor will be taken under very serious consideration. Thank you.

1/14/2021, 7:58:23 AM

Support: Talked to my boss. When he heard about the decryption tool being needed, at first he was ready to move back to the previous offer or at least move to 1.2mil (x2 from the data offer), but we've decided not too be hard on you and are ready to stay at $750k. Take this to the management and let me know what they decide.

1/14/2021, 1:57:30 PM

[redacted]: I appreciate you trying. We have a lot of money set aside for this but $750,000 just won't be possible. If the price was $600,000 then we may have been able to push closer to that. But at $750,000, it is just so far...

1/14/2021, 3:02:47 PM

Support: We can leave it $600k if the transfer will be done today or tomorrow. The BTC wallet is : [redacted]

1/14/2021, 3:05:00 PM

[redacted]: Let me discuss with the team. This is still above our budget but we can try to work towards it quickly. Thanks.

1/14/2021, 3:10:31 PM

[redacted]: We took this management and discussed. They were certainly appreciative of you being able to include the decryptor in the $600,000 price. While the price itself is still high for us, we feel more confident in being able to move past this with you. We may be paying more than the value, but want to keep the positivity in our discussions. As a result, we can increase our offer to $450,000 and can begin the transfer soon if you are with us. Thank you.

1/14/2021, 10:51:32 PM

Support: $600k. take it back.

1/15/2021, 12:23:42 AM

Support: And the sum will be increased if we will not receive the funds within mentioned time frames.

1/15/2021, 12:24:47 AM

[redacted]: Well, increasing the sum is not going to get us any closer. I will get back to you in a bit.

1/15/2021, 7:44:07 AM

[redacted]: We had an early morning call. $450,000 is our limit and this is more than what we anticipated paying. We can start the payment process soon if you can agree. Otherwise, this may not be the ending we had hoped for.

1/15/2021, 1:06:43 PM

[redacted]: We know you worked hard to make this work and we appreciate it. It's just that we're at our limit.

1/15/2021, 1:11:35 PM

Support: You still have a little time to conclude an agreement on the terms above. Then the price will increase.

1/15/2021, 5:48:18 PM

[redacted]: We have worked day and night to make this work and we understand you're doing the same. If the price goes up then there is no way we can pay. All we ask is for a little help so that we can get the cash in your hands. $450,000 is not a small amount for us.

1/15/2021, 5:51:22 PM

Support: I'm sorry. I'll talk to the boss today, but I'm afraid he'll stand his ground.

1/15/2021, 5:53:04 PM

[redacted]: Thank you. That would be helpful

1/15/2021, 6:16:59 PM

[redacted]: Did you talk to your boss today?

1/16/2021, 8:28:15 AM

Support: Not yet, will update you as soon as he replies.

1/16/2021, 12:32:26 PM

Support: Ok. $450k. BTC wallet : [redacted]

1/16/2021, 3:28:31 PM

[redacted]: Thank you. Can you confirm what we will receive in return of a $450,000 payment?

1/16/2021, 3:59:08 PM

Support: - Decryption tool. - Your data will be wiped from our servers - Security improvement tips

1/16/2021, 4:11:58 PM

[redacted]: And the files will be uploaded to mega.nz for us to review?

1/16/2021, 4:25:54 PM

Support: we can upload on mega. yes.

1/16/2021, 4:41:15 PM

[redacted]: Ok, we'll be in touch. It may be hard since this is a holiday weekend but we'll send an update

1/16/2021, 4:45:20 PM

[redacted]: We're hoping to pay by tomorrow, since today is a holiday. Ok?

1/18/2021, 1:59:59 PM

Support: Yes. Let me know as soon as the transfer is made.

1/18/2021, 3:06:36 PM

[redacted]: Still here? Can you confirm the wallet for $450,000?

1/19/2021, 2:04:16 PM

Support: Yes, just a minute.

1/19/2021, 2:14:23 PM

Support: The BTC wallet is the same : [redacted]

1/19/2021, 2:14:45 PM

[redacted]: We have paid. Please confirm

1/19/2021, 7:17:31 PM

Support: The payment is pending. As soon as it's confirmed you will be provided with decryption software with the instructions on how to use it.

1/19/2021, 7:19:28 PM

[redacted]: Ok. And when will get access to the files that you took?

1/19/2021, 7:32:36 PM

Support: We will upload them to the mega.nz share the soonest possible.

1/19/2021, 7:33:30 PM

[redacted]: Do you have our tool yet?

1/20/2021, 8:26:11 AM

Support: Will be ready within next 4-5 hours.

1/20/2021, 10:24:45 AM

Support: [redacted]_decryptor.exe [ 102kB ]

1/20/2021, 3:12:06 PM

[redacted]: We're taking a look now. Any update on mega.nz?

1/20/2021, 3:22:04 PM

Support: It's pretty much data so it keeps being uploaded. Will update you as soon as it's ready.

1/20/2021, 3:22:59 PM

[redacted]: Thank you. Please keep us updated

1/20/2021, 4:24:43 PM

[redacted]: Will it be available today?

1/21/2021, 1:21:53 PM

Support: please wait. about 1 tb

1/21/2021, 2:21:46 PM

Support: %50 ready wait

1/22/2021, 3:04:28 AM

Support: %90 ready

1/22/2021, 7:50:03 PM

[redacted]: Ok. Please keep us updated

1/22/2021, 7:51:54 PM

[redacted]: Is there any update on when mega.nz will be ready?

1/23/2021, 2:00:30 PM

Support: i check now wait

1/23/2021, 2:26:25 PM

Support: https://mega.nz/folder/[redacted] check please download all and open first archive unzip and see write please and we will delete from mega

1/23/2021, 2:27:37 PM

[redacted]: Thank you. I will let you know.

1/23/2021, 8:48:20 PM