Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

25.01.2023 09:57:20 UTC
Avatar

Good morning, you encrypted some of our machines.

25.01.2023 10:02:39 UTC

Hello, you pay - we give you decryptor.

25.01.2023 11:52:59 UTC
Avatar
Avatar

What about our data?

25.01.2023 11:53:24 UTC

after payment you will receive a decryptor and all copies of the data will be deleted from our servers

25.01.2023 12:07:39 UTC
Avatar
Avatar

what did you steal? and what amount of money are you looking for?

25.01.2023 13:04:45 UTC

we copy 30Gb data. file listing only after payment. Price for yoour company is 400k USD in Bitcoin or 380k USD in Monero

25.01.2023 13:14:13 UTC
Avatar
Avatar

Why would we believe you without any proof? At first you only mentioned teh decryptor.

25.01.2023 13:15:02 UTC

You think I didn't take anything from your network? Why do you need proof if your files are encrypted? Obviously, I took the files when I was a guest at your place.

25.01.2023 13:21:50 UTC
Avatar

File: [1.png]

25.01.2023 13:22:30 UTC
Avatar

File: [2.png]

25.01.2023 13:22:36 UTC
Avatar

File: [3.png]

25.01.2023 13:22:49 UTC
Avatar

File: [4.png]

25.01.2023 13:22:55 UTC
Avatar
Avatar

Ok we checked with the people who know that data. That is not critical. And I saw, that you deleted the decryptor, so you can't decrypt anymore?

26.01.2023 15:37:32 UTC

Decryptor will delete at - 2023-03-16 22:04:06

26.01.2023 16:23:28 UTC
Avatar

Decryptor not deleted.

26.01.2023 20:20:04 UTC
Avatar
Avatar

Now it shows correctly. Thanks. So to be frank. The encryption is not really an issue. The lost data might be. However, as I said, the data above is not critical. Management will need something better.

27.01.2023 16:05:53 UTC

Ok, we will be prepare your database for public

27.01.2023 17:27:36 UTC
Avatar

your data is huge. the screenshots above are examples of random files. but what will be critical for you - may be in the total volume of data. Are we going to negotiate further?

29.01.2023 13:49:33 UTC
Avatar

http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/pBI4qxYrgfRwnYPN63d679e4254be

29.01.2023 13:50:26 UTC
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton