Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

02.01.2023 19:09:19 UTC
Avatar

Hello dear sirs, How much to unencrypt files on my network?

02.01.2023 19:10:34 UTC
Avatar

bump

02.01.2023 21:47:37 UTC

300 000$ fo all

03.01.2023 00:04:44 UTC
Avatar

300 000$ for all pc

03.01.2023 00:05:24 UTC
Avatar

Also, if you have any thoughts of refusing to pay 2023-02-21 07:16:07, we will publish the data that was stolen from your online storage. If you choose to use the backups you have, we will simply publish your company's financial documents. At the moment your documents are being processed in our TOR cloud storage, in about 2 weeks they will be available. For now, we can only report the volume of stolen data - 30 GB.

03.01.2023 00:20:38 UTC
Avatar
Avatar

Thank you for the update. I will let management know.

03.01.2023 00:26:35 UTC

ok

03.01.2023 00:27:37 UTC
Avatar
Avatar

Trying to understand what 300,000 is for. This will unencrypt the files on network? I am being told that some are encrypted with lockbit 2.0 and others with 3.0. Is this able to be done at once?

03.01.2023 20:04:42 UTC

300,000 for all computers. We will give you both versions of the decryptor for both the 2.0 and 3.0 Black versions

03.01.2023 20:06:33 UTC
Avatar
Avatar

And the published data?

03.01.2023 20:10:21 UTC

The data will not be published and will be deleted automatically upon payment

03.01.2023 20:11:00 UTC
Avatar
Avatar

Thank you. I will relay the information.

03.01.2023 20:13:44 UTC

ok

03.01.2023 20:15:09 UTC
Avatar

File: [files_tree_b4e3588c39.txt]

05.01.2023 05:26:10 UTC
Avatar

This is a list of your data that was stolen.

05.01.2023 05:27:13 UTC
Avatar
Avatar

Is this a complete list?

05.01.2023 12:22:15 UTC

Yes

05.01.2023 12:22:46 UTC
Avatar
Avatar

Thank you, I will relay.

05.01.2023 12:23:24 UTC

ok

05.01.2023 12:23:34 UTC
Avatar

any info?

07.01.2023 19:22:38 UTC
Avatar

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/VYc1R91Gxwt5BDy663ba99b790b12

09.01.2023 16:43:52 UTC
Avatar
Avatar

We are recieving phone call because we are no communicating in chat. I this your team or am I communicating on the wrong channel? I have been tasked in finding out what country your group originates from and if there is any movement on the number you have given?

09.01.2023 16:45:18 UTC

Yes the call was indeed made by us

09.01.2023 16:46:19 UTC
Avatar

We attack companies all over the world and speak virtually every language.

09.01.2023 16:50:11 UTC
Avatar
Avatar

I'm sure you do, but to which country is the money going when you get paid?

09.01.2023 16:52:38 UTC
Avatar

Also, is there a movement on the 300,000

09.01.2023 16:54:01 UTC

The payment is made in BTC cryptocurrency and you will never know about it. However, we can say that we are not political hackers, you just have weak security and we need money, that's all.

09.01.2023 16:55:29 UTC
Avatar

bc1qx9upga7f09tsetqf78wa3qrmcjar58mkwz6ng6 - BTC wallet

09.01.2023 16:57:36 UTC
Avatar
Avatar

300,000 is a lot of $$. Can that be reduced?

09.01.2023 16:58:59 UTC
Avatar

On your feed, it says $500,000

09.01.2023 16:59:15 UTC

If the documents that we have get into the public domain, believe me, this amount will seem insignificant because of the losses that can result from leak

09.01.2023 17:00:50 UTC
Avatar
Avatar

I will take that information back to them.

09.01.2023 17:02:23 UTC

This is the price for your competitors, if someone wants to buy your company's internal documentation, we will sell it to them, but the sooner you pay the amount offered to you, the less likely it is that someone will use the information

09.01.2023 17:03:05 UTC
Avatar

If you want to keep your data from falling into the wrong hands or other organizations, you need to resolve the $300,000 ransom payment as soon as possible, and the data will be destroyed

09.01.2023 17:05:09 UTC
Avatar

And accordingly you get a decryptor for both versions of Lockbit 2.0 and 3.0 black

09.01.2023 17:06:12 UTC
Avatar
Avatar

Appreciate the clarification

09.01.2023 17:07:21 UTC

Do you have any new information? Have you started preparing to pay yet?

10.01.2023 18:07:05 UTC
Avatar
Avatar

I do not at this time.

11.01.2023 14:37:45 UTC

You have 17 days left, we advise you to prepare everything in advance

11.01.2023 14:38:54 UTC
Avatar
Avatar

Noted.

11.01.2023 15:22:53 UTC

Hi, do you have any new information?

13.01.2023 19:56:20 UTC
Avatar

We are willing to drop the price for you. The final price is $200,000 this is our final offer!

25.01.2023 17:44:24 UTC
Avatar

This information is provided by Valéry Marchive