Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

27.01.2023 22:48:43 UTC

hi. to decrypt the data and avoid publication you need to pay us. we haven't published your name on our blog yet

27.01.2023 22:49:52 UTC
Avatar

soon we will send you a tree of stolen data

27.01.2023 22:51:46 UTC
Avatar
Avatar

We found your telling us to come here. What is going on?

27.01.2023 22:52:33 UTC

need to pay

27.01.2023 22:53:31 UTC
Avatar

http://lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion/r/EmcJ0p6nJv#59UjkgcJ3APksKHGhDXjpNhhXTNkiMXxsVAGPmV7DOA=

27.01.2023 22:54:42 UTC
Avatar
Avatar

Thank you for the list. You said we need to pay, how much is that?

28.01.2023 14:10:03 UTC

250000$

28.01.2023 17:13:02 UTC
Avatar

after payment, we will delete your data and provide a decryptor

28.01.2023 17:13:29 UTC
Avatar
Avatar

The list is with leadership for review. Is this the full list of all data taken?

29.01.2023 15:32:02 UTC

yes

29.01.2023 15:35:40 UTC
Avatar

time to pay now

30.01.2023 12:51:00 UTC
Avatar
Avatar

Thank you for answering our questions. The leadership is reviewing the file list. No one was here over the weekend to get this done. Thank you for your patience.

30.01.2023 14:12:26 UTC

OK

30.01.2023 14:14:21 UTC
Avatar
Avatar

the list is rather large! How much data in all did you take? It seems like alot!

31.01.2023 15:09:59 UTC

all the data we took is on this list. when you pay, we will permanently delete it, and decrypt all your systems. the sooner you pay, the sooner it will be over and you will go back to your old life

31.01.2023 17:16:04 UTC
Avatar
Avatar

How do we know you have this data?

01.02.2023 14:29:52 UTC

select some files from the tree, and we will send them

01.02.2023 14:31:07 UTC
Avatar
Avatar

OK. I will get with my leadership so they can choose what files to send.

02.02.2023 13:49:01 UTC

hurry

02.02.2023 14:20:41 UTC
Avatar
Avatar

It's a long list. How much data is this?! We are hopeful to have the file names for you today or tomorrow morning.

03.02.2023 14:03:48 UTC

ok

03.02.2023 14:06:39 UTC
Avatar
Avatar

Here is the list of files. NEWBRIDGE\2021 DMHAS license\licenses expansion\attachmentsCO - Parsippany.pdf \ NEWBRIDGE\HR\HR FORMS\Job Posting & Change FormsCHANGE OF STATUS Checklist 1.14.2020.docx \ NEWBRIDGE\HR\Job Announcements\2022Clinician Sparta-FT internal- 9.2.22.docx \ NEWBRIDGE\HR\HR FORMS\AccommodationsAccommodation REQUEST - Employee.docx \ NEWBRIDGE\2021 DMHAS license\continuation letter 1.26.21New Bridge Services Inc. 1-26-21 Continuation Letter (003).docx

04.02.2023 13:34:47 UTC

ok, wait

04.02.2023 15:01:28 UTC
Avatar

http://lockbitfile2tcudkcqqt2ve6btssyvqwlizbpv5vz337lslmhff2uad.onion/r/tASrJy1eXM#9fOlbyIxE9fmiNNfZSDfX9PJ19RHcrlhxrJ9/99f7Bg=

04.02.2023 15:32:14 UTC
Avatar

password qtuhK4vpjG^fgM5ZRm$psn5mO

04.02.2023 15:32:31 UTC
Avatar
Avatar

Thank you for the files. I will give them to my leadership to review.

05.02.2023 14:13:15 UTC

OK

05.02.2023 14:20:11 UTC
Avatar
Avatar

what is the next step in this process?

07.02.2023 17:26:34 UTC

You pay

07.02.2023 17:27:04 UTC
Avatar
Avatar

How do we know you can fix our systems?

08.02.2023 14:17:21 UTC

You have the opportunity to make test decryptions

08.02.2023 14:30:14 UTC
Avatar

After payment, we will provide you with a decryptor for the entire network, identify vulnerabilities and delete your data

08.02.2023 14:31:15 UTC
Avatar
Avatar

How do we make test decryptions?

09.02.2023 14:23:11 UTC

There is a mention on your page, upload a small encrypted file

09.02.2023 14:27:49 UTC
Avatar

Please perform the actions faster.Otherwise, we will change the negotiator, and make mentions of your company on the blog.

09.02.2023 14:30:22 UTC
Avatar

I know that your goal is to drag out negotiations as long as possible so that we get nervous and agree to a smaller amount. by asking dumb questions you are playing against yourself and risk getting blogged. the test decryptor window is to the left of the chat.

09.02.2023 15:54:14 UTC
Avatar
Avatar

We are not trying to drag anything out. We have never dealt with anything like this before and I wanted to be sure. I will get my leadership team to give me some files.

09.02.2023 20:34:17 UTC

you can say what you want, but we have a lot of experience and we understand everything. each machine has its own ID. for a successful transcription you need to take the file from your PC, with the ID you are logged into the chat! or go to the chat with the ID of the PC from which you take the file for test decryption

09.02.2023 20:43:48 UTC
Avatar
Avatar

The decrypted file that you sent us looks corrupt. Can we send you another one.

10.02.2023 17:10:11 UTC

You can follow the link to the chat from any PC, take the file from this PC and use the test decryption

10.02.2023 17:53:46 UTC
Avatar
Avatar

We tried to do it on another PC. Your decrypt tester is not letting us upload any more files.

10.02.2023 19:44:28 UTC

send the file, we will decrypt it for you. it should not be an important file, a picture or pdf

10.02.2023 19:47:38 UTC
Avatar
Avatar

https://anonfiles.com/6cC1jbX1y7/LcfUDlk_dB6AsqMxo

10.02.2023 19:52:30 UTC
Avatar

We've tried to attach more files in the chat but it wont work. Does this work for you?

10.02.2023 19:53:06 UTC

ok, wait

10.02.2023 19:58:37 UTC
Avatar

File: [inetres.adm.7z]

11.02.2023 06:09:27 UTC
Avatar
Avatar

Thank you for the file. I gave it to my leadership to review.

13.02.2023 14:49:12 UTC

hurry up! very slow

13.02.2023 14:50:08 UTC
Avatar
Avatar

My leadership said that they don't know what that file was that you sent and they wanted to send another one.

14.02.2023 15:26:58 UTC

You sent us the file yourself. Okay. Send us another file

14.02.2023 15:32:25 UTC
Avatar

You will do the test yourself faster if you perform the action correctly.Your visiting this chat room once a day does not contribute to the solution.

14.02.2023 19:23:08 UTC
Avatar
Avatar

Ok. We will find one and get back to you ASAP.

14.02.2023 20:22:30 UTC

hurry up

14.02.2023 20:24:09 UTC
Avatar
Avatar

Since all the names were changed on our files it is taking a long time making the appropriate selection.

15.02.2023 19:45:34 UTC

It takes a maximum of 1 hour.We are well aware that you are a representative of the recovery company and want to earn yourself.But in fact you are damaging your clients and yourself as a negotiator

15.02.2023 19:52:45 UTC
Avatar

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/MM3CQtzq3b0kInv663edf735a5c73

16.02.2023 09:27:18 UTC
Avatar

You have time to think about whether to drag out the negotiations further, or pay up and close the matter quietly.

16.02.2023 09:28:12 UTC
Avatar
Avatar

I'm not part of a recovery company. We are trying to work with you. Once you publish our data there will be no point in talking with you. I will check with my team on the status of getting more sample files.

16.02.2023 14:25:40 UTC

don't care! you won't scare us with this. you've been taking too long, whoever you are. your name will be published first, and then only your details. if you don't pay, others will pay. our patience is over

16.02.2023 14:29:44 UTC
Avatar
Avatar

https://anonfiles.com/V2Ad7eYfy1/6X0RFtq_dB6AsqMxo

16.02.2023 23:08:52 UTC

ok, wait

16.02.2023 23:15:45 UTC
Avatar

File: [Quality Management Coordinator 12.1.2017.pdf.7z]

18.02.2023 11:23:28 UTC
Avatar

when will you pay?!

20.02.2023 12:26:55 UTC
Avatar
Avatar

My leadership is going to meet to discuss this.

21.02.2023 14:12:04 UTC

Hurry up

21.02.2023 14:13:48 UTC
Avatar
Avatar

The leadership meeting has been delayed due to something beyond our control. Thank you for your continued patience with us.

22.02.2023 16:04:18 UTC

If you hope that by delaying negotiations you will lower the price, you are mistaken

22.02.2023 16:09:54 UTC
Avatar
Avatar

I am not trying to delay negotiations. I have not heard back from the board yet.

24.02.2023 15:11:12 UTC

it's time to pay

27.02.2023 06:23:24 UTC
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton