Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

23.10.2023 21:20:08 UTC

Hello

23.10.2023 21:20:53 UTC
Avatar
Avatar

We got the instructions and links on the note you sent us. What do we do from here?

23.10.2023 21:21:42 UTC

You need to pay the ransom.

23.10.2023 21:22:13 UTC
Avatar

After you will pay us, we will delete the stolen files we have from you and we will provide you a working decryptor.

23.10.2023 21:24:40 UTC
Avatar
Avatar

how much is that?

24.10.2023 00:41:08 UTC

700k usd in btc or xmr .

24.10.2023 00:41:42 UTC
Avatar
Avatar

We will pass that along to our leadership. How does your decryptor work and what files were stolen?

24.10.2023 16:42:47 UTC

We will send you a list to see what files we have, the decryptor is simple to use, just run it on servers and it will decrypt them.

24.10.2023 17:21:24 UTC
Avatar

http://lockbitfile2tcudkcqqt2ve6btssyvqwlizbpv5vz337lslmhff2uad.onion/r/N0FxGMmArB#eyKMM1kk5gcRkCieSShYGa6jt9rShnmZ5ZGExDLgg2w=

24.10.2023 20:53:56 UTC
Avatar

total size of files stolen 176gb .

24.10.2023 20:54:15 UTC
Avatar
Avatar

Where are you keeping those files? Can we request some of them so we know you have them?

26.10.2023 21:27:42 UTC

yes you can pick random files and we will give them to you . we store them on our own servers.

26.10.2023 21:40:25 UTC
Avatar
Avatar

Okay, thanks. Can you send us these files we saw in your list? Lockbit\victim\dees-ae.com\Archive\[redacted]\Healthcare Benefits File: Enrollment Email.doc Lockbit\victim\dees-ae.com\Employees\Active\[redacted] File: OrientationSchedule.doc Lockbit\victim\dees-ae.com\USERS\[redacted]\Manual Invoices\[redacted]-Intel Pmt App\9905003 File: 9905003-45740PayApp.xls Lockbit\victim\dees-ae.com\R&D Tax Credit\2016 R&D Tax Credit\Project Documentation\10035002 File: 00- Original Plan.pdf Lockbit\victim\dees-ae.com\USERS\Lvo\Bradford Investments\2019 File: 2019 Adjusting Journal Entries.pdf Lockbit\victim\dees-ae.com\USERS\[redacted]\Backup Copies\2021\2021-08\August 2021 Backup File: 10250001-Waiver.pdf

27.10.2023 20:04:27 UTC

http://lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion/r/H8ty645VaY#d2q8iaOoB6aonIO9RWWRaz9AZPsG77q4Fsumkj8uzxk=

27.10.2023 20:32:33 UTC
Avatar

here are the files you requested .

27.10.2023 20:32:34 UTC
Avatar
Avatar

Last week you told us your decryptor was simple to use. How do we know it will work on our files?

30.10.2023 21:28:40 UTC

because thats how ransom works , you can read about ransom on the internet . you are not the only one that purchase decryptor . you dont need to worry about that .

30.10.2023 21:34:36 UTC
Avatar

staling wont get you anywhere , we already answered to all of your requests, if you continu on this path i will see myself forced to input a deadline .

31.10.2023 01:15:58 UTC
Avatar
Avatar

It's easy for you to tell us not to worry about your decryptor, but given the amount you're asking us for, we're not going to consider any payment here unless you can show us in some way that it will work on the files of ours that you encrypted. We see the Trial Decrypt on this page but we don't have a file that small. If we upload some files directly to this chat, will you decrypt them to show us we can get everything back?

31.10.2023 21:42:04 UTC

Yes

31.10.2023 21:43:04 UTC
Avatar

We can decrypt larger files, but without any important data on them

31.10.2023 21:44:53 UTC
Avatar
Avatar

Okay, we'll find some files and upload them here soon.

01.11.2023 15:39:14 UTC
Avatar

File: [encrypted files.zip]

03.11.2023 16:01:10 UTC
Avatar

Can you decrypt these files we've uploaded here?

03.11.2023 16:01:31 UTC

File: [encrypted files.rar]

04.11.2023 20:06:35 UTC
Avatar

you have 48 hours to come to an agreement or we will post your files and ban you from this chat .

06.11.2023 13:38:02 UTC
Avatar
Avatar

We will review the files to ensure they look correct. And we will need to meet to discuss our finances and see where we stand. We will update you after we meet. We'll probably need more than 48 hours and ask that you please be patient and not ban us from this chat.

06.11.2023 20:14:29 UTC
Avatar

Our team is still reviewing our finances. Unfortunately, we have some individuals out because of the holiday weekend and we won't be able to get everyone's input on a decision until Monday. Again, we request that you please be patient with us and we will be back in touch once we have a better update to give you.

08.11.2023 23:02:03 UTC

As far as we stand , we complied to all of your demands so far , but we see you are not a good faith . this time the 48 hours to get to an agreement will start if not i m posting the files.

13.11.2023 23:01:58 UTC
Avatar

Congratulations your famouse you have 48 hours until files will be posted .

23.11.2023 16:52:58 UTC
Avatar

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/aFDgjvQa1103zhzG655f82e37c80d

23.11.2023 16:53:00 UTC
Avatar

This information is provided by Valéry Marchive