Ransomware negotiation(s) with  conti



Avatar

Is anyone here? What do we have to do now?

5/8/2021, 2:55:28 AM

Hello. In addition to encrypting your files, we also downloaded important data from your network. We can provide you with a list of the files that we took from you, from this list you can choose any 2 files to make sure that we have the physical presence of your files. You can also select any 2 files and send them to us and we will decrypt them for you to make sure that your decrypted key is working. In order to avoid disclosure of your data on our website contunews.icu, get the decrypt key and security advice, you must pay a ransom of $ 3.000.000

5/8/2021, 3:26:03 PM
Avatar
Avatar

So you locked our files and took them? And we have to pay three million dollars to overcome this?

5/8/2021, 5:13:13 PM
Avatar

[redacted] Invoice for Transaction_ 549.pdf.[redacted] [ 10kB ]

5/8/2021, 5:13:47 PM
Avatar

Uploaded one file for you. Can you fix it and send the list?

5/8/2021, 5:14:20 PM

[redacted] Invoice for Transaction_ 549.pdf [ 9kB ]

5/8/2021, 7:29:04 PM
Avatar

That's right, you have to pay $3 million to avoid publishing the files and get the decryption. We sent you the decrypted file. We will also send you a list of the files we took.

5/8/2021, 7:31:07 PM
Avatar
Avatar

Thank you for sending this over. When will you send over the list of files that you took that you mentioned yesterday?

5/9/2021, 12:12:54 PM

Hello, we haven't forgotten about you. We will send in the near future

5/9/2021, 12:51:36 PM
Avatar
Avatar

Ok thank you, I appreciate the update. We are discussing the amount internally and will stand by for when the list is ready.

5/9/2021, 1:49:32 PM

log.txt [ 3.8MB ]

5/9/2021, 9:01:44 PM
Avatar
Avatar

Thanks we'll take a look tomorrow

5/9/2021, 9:06:49 PM
Avatar

These are all of the files?

5/9/2021, 9:07:39 PM

Yes, these are all the files. We didn't take many files, but enough to publish and send to those who may be very interested in them in case our negotiations are not successful.

5/9/2021, 9:25:27 PM
Avatar
Avatar

Okay thank you for the information, we will speak tomorrow

5/9/2021, 9:30:43 PM

Ok

5/9/2021, 9:37:48 PM
Avatar
Avatar

Hi is someone here?

5/10/2021, 6:56:27 PM
Avatar

We reviewed the data that you send and appreciate the full list in the text file. We are still trying to access internally the extent of the damage with our files that are locked. The board did tell me that there is no way we can pay $3,000,000 but we do want to work with you. Is there any way you could come down on the price and I will bring it to the board to see if they will approve?

5/10/2021, 7:00:09 PM

We will make concessions and give you a 30% discount

5/10/2021, 7:07:29 PM
Avatar

Both you and we are well aware that you will incur losses many times greater than the amount requested if your files are published and your network is in an encrypted state. In addition, trying to recover your files yourself will result in their loss and destruction, keep in mind.

5/10/2021, 7:13:41 PM
Avatar
Avatar

Ok thank you very much for this discount. I will prepare a meeting with the board and will get back to you as soon as possible with an update.

5/10/2021, 8:37:25 PM

Okay.

5/10/2021, 8:45:37 PM
Avatar
Avatar

Hi, I had a meeting with the board today and I need to have one with our finance department tomorrow afternoon. I'm really sorry for the delay, but because of how much money you are asking it requires a lot of sign off and approvals. I will write you here as soon as I finish with our finance team.

5/11/2021, 8:36:26 PM

Ok

5/11/2021, 8:51:28 PM
Avatar
Avatar

Are you here? I have some news

5/12/2021, 7:54:41 PM
Avatar

I really appreciate your patience with me the last few days and for the reduction to $2,100,000. I met with the board and the finance team over the last several days and based on the data that has been locked and what was taken we are prepared to offer you $210,550 and can send you the money before the end of the week.

5/12/2021, 8:01:06 PM

No, we are not satisfied, these are ridiculous numbers. In 3 days we will start to publish your data on our website and send it to interested parties, also this chat will be deleted, in the future you will not be able to get a transcript. Good luck.

5/12/2021, 9:31:33 PM
Avatar
Avatar

This was just our first offer based on what we currently know. Why are you responding to such an extreme. Everything I read online about conti said that you were good to work with and that you helped people. If you can't accept our offer, ok. But can you come down and allow me the opportunity to see if i can come up with more money? Please, we want to work with you on this to come to a quick and positive conclusion for us both.

5/13/2021, 1:19:02 PM

Yes, we will give you that opportunity, we always make concessions. It seemed to us that you decided to play with us by naming such amounts. Have a good day and good luck.

5/13/2021, 2:19:25 PM
Avatar
Avatar

Ok thank you! I did not mean to insult at all and I'm sorry if it came off that way. I will work to try and come up with a better number and will get back to you as soon as I can.

5/13/2021, 2:41:48 PM

Okay, good luck.

5/13/2021, 3:21:38 PM
Avatar
Avatar

Hello

5/14/2021, 6:33:06 PM
Avatar

I met with the board and the finance team again the last 24 hours and we are working hard to get you more money. We want to try and come up as much as we can because we do not want to offend you with another offer that may be to low. Can you please give us the weekend to try and pull together as much as we can and I will write you here on Monday early afternoon?

5/14/2021, 6:40:28 PM

Hello

5/14/2021, 11:10:16 PM
Avatar

Yeah, no problem, we'll give you those deadlines. Have a good day.

5/14/2021, 11:11:46 PM
Avatar
Avatar

Hi are you here? I have an update

5/17/2021, 8:50:17 PM

Yes

5/17/2021, 9:38:55 PM
Avatar

What's the news?

5/17/2021, 9:47:11 PM
Avatar
Avatar

We appreciate the extra time you gave us and got a lot more money. We're now able to pay you $325,550. We hope this can be a good concession

5/17/2021, 10:44:18 PM

We really appreciate your efforts to get more money. These negotiations have been going on long enough, so let's settle for $500,000. After that, we'll give you the decryption key, return the files, and close this case.

5/17/2021, 11:01:43 PM
Avatar
Avatar

I'm grateful for this! It's much closer to what we have than $2m. We may need the rest of the week to get more money, is this okay for you?

5/18/2021, 2:48:39 AM

Yes, let's close this issue this week.

5/18/2021, 12:21:40 PM
Avatar
Avatar

Ok I will keep checking in with you but I should hopefully have the remaining amount of funds by thursday, no later than friday. We have a full schedule today to try and identify the assets to use. I will reach out tomorrow with a further update. thank you again!

5/18/2021, 2:09:17 PM

Okay, thank you.

5/18/2021, 2:38:29 PM
Avatar
Avatar

Hi good morning, I just wanted to check in with you. It's looking like we're on track for Friday. We have a few meetings today and tomorrow and tomorrow afternoon we will be initiating a bank transfer which will take 24 hours to clear. I will check in with you again tomorrow to confirm everything is moving as scheduled.

5/19/2021, 2:42:36 PM

Great. Now I will send you a bitcoin wallet, to which you need to send the amount, and then we will fulfill the conditions that we agreed on.

5/19/2021, 3:08:14 PM
Avatar

[redacted]

5/19/2021, 3:11:05 PM
Avatar

This information is provided by Valéry Marchive