Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

17.01.2023 16:11:13 UTC
Avatar

Hi.

17.01.2023 16:13:32 UTC
Avatar

Hello, I'm wondering if anyone is available to assist? Thanks.

17.01.2023 21:21:03 UTC

Hello

17.01.2023 21:44:17 UTC
Avatar

How I can help you?

17.01.2023 21:51:04 UTC
Avatar
Avatar

Hi, my company's computer network was affected by a virus. There was a note that instructed we reach out to you. I was asked by my employer to find out from you if you have taken any data from our systems? And anything you can share about next steps would be helpful. Thank you.

18.01.2023 15:54:19 UTC

You pay - we decrypt your network.

18.01.2023 17:54:55 UTC
Avatar
Avatar

"Your data are stolen and encrypted" -- is this not the case?

18.01.2023 20:27:01 UTC

You pay - we decrypt your network and delete your data.

18.01.2023 20:51:50 UTC
Avatar
Avatar

Do you have a list of the data?

18.01.2023 22:09:06 UTC

You will receive a complete list of the stolen data only after you pay the ransom.

19.01.2023 08:23:23 UTC
Avatar

File: [07-15-22 master control - brands 1099.pdf]

19.01.2023 08:23:42 UTC
Avatar

File: [10-30-22 stat summary - gbi svc 1099.pdf]

19.01.2023 08:23:46 UTC
Avatar

File: [12-30-22c checks - jj.pdf]

19.01.2023 08:23:51 UTC
Avatar

File: [2021 K-1 - JWNII Living Tr - Nicklaus DC Invest.pdf]

19.01.2023 08:26:14 UTC
Avatar

File: [Jim Schnare with Passport.jpg]

19.01.2023 08:29:03 UTC
Avatar
Avatar

Ok, thank you. What/how do we pay you?

19.01.2023 13:55:58 UTC

$7,000,000 in bitcoin, or $6,900,000 in monero

19.01.2023 15:10:50 UTC
Avatar
Avatar

You're asking for 7 million dollars for this?

19.01.2023 15:19:07 UTC

You are a very famous brand, it is a very good price not to ruin the reputation of the Golden Bear, why your director at 82 years old hundreds of millions of dollars? he will not have time to spend them the rest of his life anyway, so 7 million dollars is a very fair price so that no one will ever know about our attack.

19.01.2023 15:26:50 UTC
Avatar
Avatar

Good morning. I have passed on your messages to my bosses. They will be discussing with the board this weekend or early next weekend. I will get back to you then. Thanks.

21.01.2023 11:05:02 UTC

Ok.

21.01.2023 13:19:50 UTC
Avatar
Avatar

Hello. It looks like my bosses have some meetings scheduled for today to discuss this. They are asking how many files you took from our systems?

23.01.2023 15:10:15 UTC

You will receive a complete list of the stolen data only after you pay the ransom.

23.01.2023 15:15:47 UTC
Avatar
Avatar

Do you have the total size you can share with me? I'd like to give my bosses some information that may be helpful in making their decision. Thanks.

23.01.2023 15:34:28 UTC

More than 200 gigabytes of data.

23.01.2023 15:40:25 UTC
Avatar
Avatar

Good morning. My bosses have meetings with partners this morning. Once I have some information, I will let you know. Thanks.

24.01.2023 15:24:48 UTC

Ok.

24.01.2023 15:56:31 UTC
Avatar
Avatar

Hello, sorry for the delay. I've been following up with my bosses for some updated information. At this point, I've been told that we don't have anywhere close to 7 million dollars. My bosses are asking what you will do with the data after we pay? Thanks.

26.01.2023 14:01:07 UTC

Advise your bosses not to be greedy, we know you have money, we own your documents, the richest people on the planet play in your clubs and nothing is more important than your reputation. In case you can overcome the greed of your bosses we will permanently delete all the stolen information and this chat room, no one will ever know about our attack on your company.

26.01.2023 16:53:54 UTC
Avatar

You need pay.

02.02.2023 19:32:23 UTC
Avatar
Avatar

Hello. Sorry for the delay. I have been talking to my bosses to get to a resolution.

06.02.2023 16:39:10 UTC
Avatar

My bosses wants me to communicate some things to you sir. Your ask for 7 million is much too high and we cannot pay this. Most of the reputation damage is already done to us just by the fact that you came into our network and took our data. The non-publication of the data is a very small part of the total damage. Our lawyers have forced us to notify our employees and customers of the breach and we already lost some business relationships as a result. We also do not have the funds to support the asking price anyway because we are spending a lot of money recovering from the breach.

06.02.2023 16:58:29 UTC
Avatar

To honor our stakeholders, we are willing to pay you something — not 7 mil. Can you please consider a lower amount. Thanks.

06.02.2023 16:58:41 UTC

Make your offer.

06.02.2023 17:22:04 UTC
Avatar
Avatar

I have a meeting in 1 hour with my bosses and lawyers and will get back to you right after.

06.02.2023 19:50:09 UTC
Avatar

My bosses said a reporter reached out and told them that our data is already published?

06.02.2023 21:25:36 UTC

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/sS6QQig1vV0mZa2T63e0f561ef4dc

07.02.2023 03:20:42 UTC
Avatar

At the moment only your company name is published, but very soon all of your information will be published if you do not pay, you have little time left. Only 48 hours to pay.

07.02.2023 03:33:09 UTC
Avatar
Avatar

Ah ok. Only 48 hours? I thought it said Feb 21?

07.02.2023 13:18:01 UTC

[Chat started] 17.01.2023 16:11:13 UTC

07.02.2023 16:21:54 UTC
Avatar

I just want to let you know that the data is ready to be published and the decryptor is ready to be deleted. You have had plenty of time to make your decision, your time is up.

07.02.2023 16:22:41 UTC
Avatar

Do you have any offer for me?

09.02.2023 12:42:51 UTC
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton