Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

23.09.2022 13:26:56 UTC
Avatar

Hello, Thank you for providing the links and ID to this chat. What proof can you give us that you have any of our data?

23.09.2022 13:28:45 UTC

We have a lot of your files

23.09.2022 13:41:23 UTC
Avatar

Hello

23.09.2022 13:41:26 UTC
Avatar

What proof do you want?

23.09.2022 13:41:44 UTC
Avatar
Avatar

Please give us a full file list of data that you say you are holding, and we can chose samples of files from list for you to give us as proof.

23.09.2022 14:55:24 UTC

Ok wait

23.09.2022 15:43:19 UTC
Avatar

Full file list size is over 8GB. we may provide you a partial listing.

23.09.2022 15:44:25 UTC
Avatar

Alright, finally uploading. Archiving significantly reduced the size. But I wonder how you will open it.

23.09.2022 15:48:59 UTC
Avatar

File list is being uploaded. It takes time. I will let you know when I'm done.

23.09.2022 16:00:40 UTC
Avatar

https://temp.sh/sRLaX/listfull.7z

23.09.2022 21:57:38 UTC
Avatar

password conti123

23.09.2022 21:57:51 UTC
Avatar

use https://www.emeditor.com to review list.

23.09.2022 22:02:44 UTC
Avatar
Avatar

Hello, Thank you for providing the proof of data. It will take us some time to verify the data. We will come back to you as soon as possible.

23.09.2022 22:04:33 UTC

The list is very large. Hope this won't take ages to review.

23.09.2022 22:07:56 UTC
Avatar
Avatar

Sorry, it has taken us a while to be able to view and start verifying the data due to the size of the file. To prove that you hold the actual data and not just a list of files, we are currently putting together a list of samples we ask you to provide. We will send you the list asap

26.09.2022 12:26:55 UTC

Hello, okay.

26.09.2022 13:36:27 UTC
Avatar
Avatar

Following up on our message from yesterday, we are still in the process of verifying information. In order to prove that you hold the actual data and not just a list of files, please can you provide the following files as proof of data held: I:\continental2\upload3\did01447\040_QAC_Cleanliness\11_Partikelmonitoring\02_Luftsauberkeit\01_Monitoring\Arbeits-Sheet-Luftsauberkeit_Auswertung Q2 2022 und Sondermessungen.xlsx, H:\continental\upload4_c2\didr1618\MMA_Fahrversuch\06_NVH-DL_Sommer_2022\Daten_NVH-DL_Block1\ATF_10\180622_004\EKB_Data\EEW\180622_004_rl_nr00109_chn0007_eew.wav, H:\continental\upload4_c2\didf3403\Common\Projects\JR-Jeff Ross\Instrumentation Master Database\Archive\Master Database Allentare Fixes March 2016.xlsx, H:\continental\upload4_c2\didb3040\MCAD\ptc\Help\Creo3\help\creo_help_pma\italian\pma\rendering\To_Open_a_Room_File.html, I:\continental2\upload3\hpfs002.tiretech.contiwan.com\HPG-Orga\GCF_TS\PROJEKTE\CT-Mexikana\!Erweiterung 6\CE\Einbauerklärung Elektrotechnik Konwima + Kernsetzer Türkei 2110791.pdf, E:\continental3\upload_c2\did43391\31_ProductDevelopment\40_Software\20_Development\BOT\CPC4_V4_16\pvcs\config\BS_Common_src.arl, F:\continental\upload4\did77091\PROJETS\Radio\RD45\07_MP\02_MP_QualityAssurance\210-Capabilité_equipements\Bizerte\Inspection optique\repetabilité vision SICKconnecteur MOST ilot 1 RD45 BCL tiroir droite.xls, E:\continental3\upload_c2\did43391\99_Workuser\Satvanyi\Boot_v04_16_with Source Address 0x32\config\BS_Appl_src.arl, F:\continental\upload4\didb3019\Konstrukce_Archiv\P-pomocne\P1-1103_Paletka_vytvrzení\Data\(5) Pojistka_výkres.idw, I:\continental2\upload3\did35017\Interior_Innovation_Vehicle\03_Development\05_Hardware\03_Parts_Components\14_HMI_PC\02_OS\Image_WINXPembed\2_Anpassungen-Tools\app\DemoFPK\DemoFPK\msgina.dll, F:\continental\upload4\didb3020\Neplatne_NotValid\Kvalita_Qualitaet\Statistika\Brandys\KS\Vn-Auswertung\2002\11_2002\VDO\Colorado\VnPlovákSest-VDO.xls, E:\continental3\upload_c2\did01155\pua\01_Operations Controlling\2022\01_Actual\01 Reporting\00_general dashboard, E:\continental3\upload_c2\did02299\TM_community_RBG\140415_Documentation_Test_Strategy_Safety_MY16, F:\continental\upload\10Werkstoffe\CR\ROHSTOFF\CC\03\58\02 VULCAN 5H (Cabot, Botlek, NET)\2 - Specification, TDS, CoA

27.09.2022 17:28:58 UTC

Hello,

28.09.2022 00:22:17 UTC
Avatar

https://temp.sh/xJTgh/proof.7z

28.09.2022 00:22:27 UTC
Avatar

password conti456

28.09.2022 00:22:41 UTC
Avatar

Files you requested are uploaded.

28.09.2022 00:23:30 UTC
Avatar
Avatar

Thank you for providing the sample files. We will verify them and come back to you.

28.09.2022 09:41:49 UTC

Hello, okay.

28.09.2022 16:26:09 UTC
Avatar
Avatar

Hello, we are still in the process of verifying information but it is taking longer than we anticipated. We hope to complete the verification work soon and appreciate your patience. Can you confirm if the list you provided covers all the data you hold?, or was it only some of it? The list did not give details of file sizes. What is the total size of all the data?

03.10.2022 09:09:43 UTC

Hello. We understand. Yes, the list contains all the data we have. You have never asked for file size information. The total size exceeds 40 TB.

03.10.2022 09:35:00 UTC
Avatar

Hello. Your silence lasts too long. You need to pay.

19.10.2022 10:16:31 UTC
Avatar
Avatar

What guarantees do you give if a payment is made?

20.10.2022 16:47:47 UTC

Hello. Your files will be deleted and nobody will know about the breach if a payment is made. Your files will appear on our leaks site if no payment is made.

22.10.2022 15:00:37 UTC
Avatar
Avatar

Hello, we have to hold a management meeting and will come back to you tomorrow end of business day.

24.10.2022 13:43:32 UTC

Hello, ok.

24.10.2022 15:46:09 UTC
Avatar

Hello, no word from your side though it is a new business day already. You need to pay.

26.10.2022 07:55:07 UTC
Avatar

Hello. We've been waiting.

27.10.2022 11:46:09 UTC
Avatar

Should we regard your silence as a rejection of the negotiation process?

28.10.2022 15:07:03 UTC
Avatar

We're starting to get your data ready to be published on the blog.

02.11.2022 00:53:22 UTC
Avatar

Our correspondence will be attached to the post.

02.11.2022 00:56:59 UTC
Avatar

http://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd.onion/post/ifdIXrXSkuP2S395636290a09365a

03.11.2022 00:15:30 UTC
Avatar

This information is provided by Valéry Marchive