Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

05.03.2023 04:03:11 UTC
Avatar

Hello. I've never done this so I'm sorry if I don't have all the information you need up front. But the ransom note said I'm supposed to contact you.

05.03.2023 04:14:18 UTC

Hello, you need pay.

05.03.2023 08:56:48 UTC
Avatar
Avatar

I've never used bitcoin before so I'm following tutorials to get it set up. I'm doing my best.

05.03.2023 13:52:11 UTC

Also we downloaded a lot of information from you.And so far we haven't published anything.There is no mention of an attack.

05.03.2023 13:58:42 UTC
Avatar

You need to pay 6000000$

05.03.2023 14:06:30 UTC
Avatar
Avatar

Oh wow, I don't know if we have that much money available. Can I see the information you took?

05.03.2023 15:01:53 UTC

Ok.wait

05.03.2023 15:04:07 UTC
Avatar

http://lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion/r/NxYjoaq6Zz#ncp9lBDKFuN2sqExl0YlgtKF/Nv3qtIHBoJ0vulmJ5w=

05.03.2023 16:39:04 UTC
Avatar
Avatar

Thank you. I'm getting a file to prove decryption works.

05.03.2023 17:26:46 UTC

ok

05.03.2023 17:30:33 UTC
Avatar

The first time we sent you an incomplete tree. In the next message there is a link to the full tree

06.03.2023 10:30:09 UTC
Avatar

Download link: http://lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion/r/7SZGD6mkDa#lOJa5TdIvZbkpeDA5BDLPO18YmFcz0dfl7u8SgwhpsY=

06.03.2023 10:30:21 UTC
Avatar

Password: Ak%xTarylM0r*jV7$qWdGs3$T

06.03.2023 10:30:31 UTC
Avatar
Avatar

Thank you

06.03.2023 18:49:48 UTC

Use the test decryptor to verify the decryption. Use it correctly. Take the file from the pc with the ID of which you logged into the chat

06.03.2023 20:51:00 UTC
Avatar
Avatar

Ok my boss is concerned since there's no way to tell what file we're decrypting that you could just send us some fake file back and claim the decryption worked.

06.03.2023 20:53:54 UTC

You know your network, your data, how is it that you can't tell? Besides, the test decryptor works in automatic mode, without my involvement

06.03.2023 20:58:47 UTC
Avatar

when wiil you pay?

08.03.2023 22:17:44 UTC
Avatar
Avatar

My engineers are working on finding a small enough file that they'll be able to confirm decryption for. I'm also working with my leadership on the financial side. We're doing our best but $6M is a lot of money.

09.03.2023 20:52:13 UTC

It's a small amount of your revenue. You can afford it. If you need time to prepare the amount, we'll give it to you, but you have to set a deadline. Our reputation and our name speaks for us, we can send you any number of files from the tree we sent you. And we can decrypt all the files we encrypted. And after payment, you'll get information about how we penetrated your network.

09.03.2023 22:53:49 UTC
Avatar
Avatar

We found a file that we should be able to confirm the content with that match your requirements. I'm just waiting for the engineer to send it to me. I'll have an update from my leadership for you soon as well.

11.03.2023 02:31:24 UTC

ok

11.03.2023 06:32:35 UTC
Avatar

You are very slow. Your name will now appear on the blog

13.03.2023 17:10:20 UTC
Avatar

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/lNnvlD8Cg2jQbYGA640f5ba593ed3

13.03.2023 17:13:45 UTC
Avatar
Avatar

I'm sorry I'm doing my best. My leadership is working with lawyers and all of that is extremely slow.

13.03.2023 17:46:19 UTC

Now you will try to negotiate faster. After all, the timer is running. More than a week has been wasted

13.03.2023 17:47:50 UTC
Avatar

when will you pay?

20.03.2023 11:34:07 UTC
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton