Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

25.01.2023 01:27:51 UTC
Avatar

I found your note on my machines what do I do now?

25.01.2023 01:31:21 UTC

hi

25.01.2023 06:05:47 UTC
Avatar

do you need decrypt?

25.01.2023 06:05:47 UTC
Avatar

we have attacked your corporate network all your 4 TRUST domains

25.01.2023 06:07:18 UTC
Avatar

and also all your servers are encrypted inside ESXI

25.01.2023 06:07:54 UTC
Avatar

we also stole 250 GB of your data from all 4 of your networks, if our negotiations are unsuccessful, you will face high fines for GDRP

25.01.2023 06:09:10 UTC
Avatar

everything is encrypted inside the virtualization of your servers, too, in order to restore all servers, this can be done with our decryptor

25.01.2023 06:12:24 UTC
Avatar
Avatar

How much is it going to cost us?

25.01.2023 14:55:22 UTC

price for decrypt, delete your data on our servers,conducting an audit of your cybersecurity company and how we infiltrated you will cost = 4 500 000 USD in BTC

25.01.2023 15:17:12 UTC
Avatar

are you interested in the list of files that we stole from you?

25.01.2023 15:24:04 UTC
Avatar
Avatar

I am interested. Can you provide the list of files taken?

25.01.2023 15:24:53 UTC

10 min

25.01.2023 15:26:04 UTC
Avatar

http://lockbitfile2tcudkcqqt2ve6btssyvqwlizbpv5vz337lslmhff2uad.onion/r/2oqRhBeCMe#lNxFt9KkQR6blBzgFQ0GUUxKSbQo6SQJf8xN8yYHqps=

25.01.2023 15:35:07 UTC
Avatar

listing here

25.01.2023 15:35:20 UTC
Avatar
Avatar

I downloaded the list. If I give you a few file names can you provide those files to show you still have them?

26.01.2023 14:13:30 UTC

yes give me name files

26.01.2023 14:14:05 UTC
Avatar
Avatar

Can you provide "cable specifications sheets-ctsp-sm8.pdf" and "tbs-sysmap 8 12 2010.pdf"?

26.01.2023 20:38:42 UTC

yes

26.01.2023 20:41:59 UTC
Avatar

wait

26.01.2023 20:42:01 UTC
Avatar

File: [Cable Specification Sheets - CTSP-SM8.pdf]

26.01.2023 20:51:58 UTC
Avatar

File: [TBS-Sysmap 8 12 2010.pdf]

26.01.2023 20:52:56 UTC
Avatar
Avatar

The second file just sends me to another lockbit page and doesn't load anything?

26.01.2023 21:13:11 UTC

now I'm moving through the file sharing service

26.01.2023 21:20:14 UTC
Avatar

http://lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion/r/ra7EVq5naF#1VV81qZWUW7DRFlvRRQAjhWZJJiBp/Bsfxuc+90gRR4=

26.01.2023 21:27:41 UTC
Avatar
Avatar

Can i give you files to prove you can decrypt them?

27.01.2023 23:01:59 UTC

Yes. You can make a test decryption by uploading the file to our portal.

27.01.2023 23:09:06 UTC
Avatar

I am notifying you that in a month your decryptor will be deleted forever automatically. and you won't be able to restore your systems.

30.01.2023 19:03:54 UTC
Avatar
Avatar

ok sorry had issues grabbing file. I am testing the decryption link on the chat.

30.01.2023 19:13:23 UTC

ok

30.01.2023 19:18:56 UTC
Avatar

you can take any small file from your PC and do the test yourself

30.01.2023 20:11:02 UTC
Avatar

so that you do not delay the negotiations and there is no action from you, then within 48 hours we will publish your company on our leaks website

31.01.2023 17:56:55 UTC
Avatar
Avatar

I have the file and testing today. I did find something odd though and wanted to get confirmation from you.

31.01.2023 20:06:45 UTC
Avatar

We found another note on one of our servers claiming to be lockbit2 and has a completely different link. Do I have to go to that link to?

31.01.2023 20:07:26 UTC

we have encrypted you with several types of our software

31.01.2023 20:08:16 UTC
Avatar

lockbit 2.0 (red), lockbit black, lockbit esxi version

31.01.2023 20:08:59 UTC
Avatar
Avatar

Is the same decryptor used or will we get multiple decryptors?

31.01.2023 20:09:36 UTC

get your own decriptors for each version, they are convenient for us and you will not have any problems

31.01.2023 20:10:48 UTC
Avatar

you can test from the version you found to make a test

31.01.2023 20:11:45 UTC
Avatar
Avatar

Ok, i grabbed a file that is too big anyways I need to grab a smaller file. I will grab a file from the lockbit 2.0 one.

31.01.2023 20:13:24 UTC

yes good

31.01.2023 20:14:51 UTC
Avatar

any updates?

01.02.2023 14:17:36 UTC
Avatar
Avatar

I got the file and testing decryption soon.

01.02.2023 14:35:31 UTC
Avatar

I received a message the file cannot be decrypted?

01.02.2023 14:36:34 UTC

send me the file here

01.02.2023 14:38:03 UTC
Avatar
Avatar

File: [insink.txt.lockbit]

01.02.2023 14:38:12 UTC

File: [insink.txt]

01.02.2023 14:51:07 UTC
Avatar

test is working! when will you make the payment?

01.02.2023 15:00:49 UTC
Avatar

any updates?

02.02.2023 15:39:59 UTC
Avatar
Avatar

$4.5 million is a lot of money.

02.02.2023 17:11:11 UTC

the price is from your income of your all companies! you're not a small company

02.02.2023 17:15:18 UTC
Avatar

why are you delaying the negotiations? are you waiting for publicity about your companies? or until the time of the decrypt runs out and he retires?

03.02.2023 14:52:02 UTC
Avatar
Avatar

We are not delaying. I am willing to negotiate the price but $4.5 million is too much.

03.02.2023 14:55:39 UTC

I am waiting for a serious offer from you closer to our price (I am ready to discuss a discount)

03.02.2023 14:56:51 UTC
Avatar
Avatar

What discount are you will to give?

03.02.2023 14:57:24 UTC

30%

03.02.2023 14:58:09 UTC
Avatar

payment for 72 hours discount will be valid

03.02.2023 14:58:43 UTC
Avatar

will you have enough time?

03.02.2023 15:23:43 UTC
Avatar

have you discussed our offer with the boss?

03.02.2023 21:19:42 UTC
Avatar

any updates?

06.02.2023 12:40:27 UTC
Avatar

your time is running out soon (discount), as well as you will lose the chance to return everything and get big fines for GTRD

06.02.2023 13:05:26 UTC
Avatar
Avatar

Sorry was trying to access the page and it wouldn't load. So i tried the other links and it gave me a blank chat.

06.02.2023 18:43:56 UTC
Avatar

I sent everything across, my boss needs more time he had to get a board meeting together. Even with the discount $3mil is a lot of money we can't get that together quickly

06.02.2023 18:44:43 UTC

you can write to any chat to us

06.02.2023 19:55:47 UTC
Avatar

How much time do you need?

06.02.2023 19:56:33 UTC
Avatar
Avatar

Ok, I didn't know that. Thanks.

06.02.2023 20:20:25 UTC
Avatar

We have the board meeting tomorrow afternoon. Could you give us another 48 hours. I would have a better understanding of the amount we can have together.

06.02.2023 20:21:11 UTC

yes, we are making concessions to you on time!

06.02.2023 21:31:59 UTC
Avatar
Avatar

Thank you! I will keep you updated.

06.02.2023 22:14:48 UTC

we wait you

07.02.2023 19:52:35 UTC
Avatar

how did the board of directors' negotiations go? the time you asked for will soon be over

08.02.2023 15:34:09 UTC
Avatar
Avatar

We are still here. The board is behind us it is more about collection of funds.

08.02.2023 21:54:21 UTC

how much time do you need?

08.02.2023 22:31:45 UTC
Avatar
Avatar

I am not sure. Just a slow process. Our insurance only covered so much. We have to make up the difference. I will get a better time frame for you. Trying to figure it out ourselves

09.02.2023 14:07:25 UTC

will we be able to fix the amount in bitcoins with you now? due to the high volatility of cryptocurrencies, it is better to fix immediately (for 48 hours)

09.02.2023 14:10:37 UTC
Avatar
Avatar

Sorry, I don't understand

09.02.2023 14:11:59 UTC

you will transfer the amount in bitcoins, the amount equivalent to the one we agreed with you, the price of cryptocurrencies often changes and we need to fix the amount that you have to transfer to us

09.02.2023 14:13:15 UTC
Avatar

138.5 BTC you need a transaction to us WALLETS

09.02.2023 14:18:32 UTC
Avatar

do we fix this amount for 48 hours?

09.02.2023 14:19:07 UTC
Avatar
Avatar

I understand. So instead of usd comparison we would do 138.5 btc. We are working to get that amount of cash to purchase the btc. insurance only covered a small percentage so we have to come up with the rest.

09.02.2023 14:25:03 UTC

hurry up, we made concessions to you and gave you a discount from our first price

09.02.2023 14:31:23 UTC
Avatar

do you have time in our time (48 hours)?

10.02.2023 15:58:24 UTC
Avatar

you here?

10.02.2023 20:51:31 UTC
Avatar
Avatar

I am still hear just trying to work on getting it together. It's a lot of money to pull together and it is taking time.

10.02.2023 20:52:08 UTC

how much time do you need? we will issue a post about you in the near future! don't try to leave for the weekend!

10.02.2023 21:11:50 UTC
Avatar
Avatar

didn't leave its not easy to get 3 mil when insurance doesn't help. We are working on the loans but it will be at least Monday.

11.02.2023 21:07:59 UTC

ok we wait you

11.02.2023 21:14:50 UTC
Avatar

any updates?

13.02.2023 16:32:12 UTC
Avatar

what news do you have?

13.02.2023 21:29:38 UTC
Avatar

ok, since you don't tell us anything, it was decided to create a blog with your companies in our blog in 3-4 hours. we will publish documents and correspondence with you (with a payment timer)

14.02.2023 17:55:50 UTC
Avatar

File: [lyonhealy.com-full-listing.rar]

14.02.2023 19:44:38 UTC
Avatar

I'm sorry I messed up the chat, it's not for you!

14.02.2023 20:45:27 UTC
Avatar

we have issued a block, with a timer and proof that we were in your network! 48 hours to get in touch

14.02.2023 20:46:09 UTC
Avatar

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/np4U8qdHNfB9QQT363ebf44bea050

15.02.2023 12:11:12 UTC
Avatar

the private link is valid for 48 hours, then you will be in our blog, will we delay the payment?

15.02.2023 14:36:40 UTC
Avatar

why are you here?

16.02.2023 18:42:21 UTC
Avatar

will you be silent as well? are we publishing all your data?

16.02.2023 18:47:08 UTC
Avatar

we will also publish this correspondence with you

16.02.2023 18:47:24 UTC
Avatar

attached our chat! it will be at the expiration of the timer!

16.02.2023 20:01:02 UTC
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton