Ransomware negotiation(s) with  lockbit3



Avatar

[Chat started]

29.06.2022 18:55:36 UTC
Avatar

Hello we are writing you as you ask in your note. How do we get our files back?

29.06.2022 18:57:50 UTC

Hello. Please tell us your company name and confirm you are an official representative of the company.

29.06.2022 18:58:06 UTC
Avatar
Avatar

We are Wabtech, I am IT mgr with firm. Thank you.

29.06.2022 18:58:58 UTC

You must pay us to get your files back.

29.06.2022 18:59:06 UTC
Avatar
Avatar

How much are you asking for?

29.06.2022 18:59:59 UTC

$25 million for universal decryptor and destruction of stolen files.

29.06.2022 19:00:10 UTC
Avatar
Avatar

Hello, we moved to here as you asked.

30.06.2022 12:57:28 UTC
Avatar

You mentioned you took out data, we need to understand that better. Please show us what you have taken so I can take this to the bosses. Thank you.

30.06.2022 12:58:22 UTC

https://temp.sh/ApbPz/wabtec_full.7z

30.06.2022 15:09:56 UTC
Avatar

password = 5446731864718376751313472162

30.06.2022 15:10:03 UTC
Avatar
Avatar

Thank you for this. I will send this to our bosses for review.

30.06.2022 16:20:41 UTC
Avatar

Our team and bosses are reviewing your large list. How much data is that? Also, would you kindly let us pick some files our of your list to ask for so we know you do indded have our data? Thank you.

01.07.2022 17:53:31 UTC

About 2 TB. Yes.

01.07.2022 19:47:51 UTC
Avatar
Avatar

Hello, can we please receive these files back from you?

02.07.2022 20:06:46 UTC
Avatar

F:\wabtec\files\WCSSRV0453_Commercial_Functions\Commercial Functions\Marketing\Marketing Effectiveness\Training Conferences\What a Declining Business Media Means to CEOs.pdf F:\wabtec\files\CommercialKnowledgePortal\Commercial Knowledge Portal\Competitor Intelligence\CI at Tradeshows\2010 InnoTrans\InnoTrans 2010 Photos\Voith\Gravita Switcher\DSC01672.jpg F:\wabtec\files\CRDSRV0008_Documentation_and_Manuals\Documentation and Manuals\Vishay Strain Gauge Manuals\Vishay Micro Measurements\Vishay M-Line Accessories.pdf F:\wabtec\files\wcssrv036_RCV_Public_Drive\RCV_Public_Drive\SAFETY\Carson\Incident -Injury Forms\WGS SAFETY ALERT NOTICE TEMPLATE.docx F:\wabtec\files\LPZSRV0014_Technologie\Technologie\ToPs_Daten\Dokumente\LASER\DATEN\5185766_1.pdf F:\wabtec\files\VCISRV0028_Project_Engineering\Project Engineering\Engineering Administration\Policies, Procedures and Guidelines\Travel Policy\Wabtec Travel and Entertainment Policy - Final_2019-11-01.pdf F:\wabtec\files\WCTSRV0018\g\PLM\WTDSRV0014\projects\DenverP3_CP\1-56468_SLDPRT\D\whereused.pdmw F:\wabtec\files\WCMSRV0006_Pre-stagedData\Pre-stagedData\Completed Projects\QJHO01001-JohnHolland-Certification of Points\E - Engineering\E2 - Deliverables\CMC - Turnout Certification\Checksheets\03.05.2018 F:\wabtec\files\Departments_hr\HR\BENEFITS\WELLNESS 2016\Wabtec Online Store Flyer.docx F:\wabtec\Manufacturing\CAR projects\Wabtec QIP Assessment Info Request.xlsx F:\wabtec\files\WTDSRV0030_Materials\Materials\Packing Slips OSWH\2022\May 2022\5-23-22.pdf F:\wabtec\files\Finance1\turbo_LP\fixed assets\TNX\Tooling\50311 Balancing tool.pdf F:\wabtec\files\BSLSRV0001_Customer_Files\Customer Files\1. Customer Information\Siemens Mobility\2021\Purchase Orders\PO 4509763478, SO-0014037, 49364-14, 2021-12-14\Buy America Certificate_Rev.1 (PO 4509763478) - Signed Dec. 22, 2021.pdf F:\wabtec\files\WBJSRV0002_Accounting\Accounting\ABNER\ateixeira\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH5IQIL6\597D3FCACB12FBFAC9CEBBAFF93D[1].jpg

02.07.2022 20:07:00 UTC
Avatar

14 total please.

02.07.2022 20:07:17 UTC

https://temp.sh/mSrti/files.7z

03.07.2022 04:20:47 UTC
Avatar

password = 5446731864718376751313472162

03.07.2022 04:20:57 UTC
Avatar
Avatar

Thank you for this. Sending to the bosses for review, be back in touch.

03.07.2022 15:43:13 UTC
Avatar

Hello, can you please decrypt these files so we know your key works per your message on this site?

04.07.2022 18:49:32 UTC
Avatar

File: [registry.xml.lockbit]

04.07.2022 18:49:59 UTC

File: [registry.7z]

04.07.2022 19:21:38 UTC
Avatar
Avatar

Thank you. So if we were considering payment, would we get 1. Working decryptor tool 2. Our data back or deleted 3. Guarantee to not publish it or leak it on dark web 4. Tell us how you got into our network? Please let us know.

05.07.2022 19:32:11 UTC

1 yes 2 yes 3 yes 4 no

05.07.2022 19:34:46 UTC
Avatar
Avatar

Ok, letting bosses know the above. We are still reviewing the data dump due to size, and will be talking to the bank to see how much funds we would be avle to come up with. Be back in touch.

06.07.2022 20:28:50 UTC
Avatar

Hello, is this all of the data you have taken from us, in your file listing? Can you please let us know. Thank you.

08.07.2022 14:36:56 UTC

Yes

08.07.2022 16:07:24 UTC
Avatar
Avatar

Ok, that is good for us to know. We will be trying to come up with as many funds as we can and are circling up with the bank when they open after the weekend. How do we get BTC? Thanks.

09.07.2022 12:40:46 UTC

You can use crypto exchanges to get btc.

09.07.2022 15:01:24 UTC
Avatar

So? Weekend ended long time ago. Are you ready to pay?

12.07.2022 17:57:34 UTC
Avatar
Avatar

Hello we are engaged with the bank, the logistics are going to take a little bit of time. This is not something we are used to deal with. We need some more time please.

12.07.2022 21:16:22 UTC

You must hurry up. We're not going to wait you forever. We'll have to raise the price by friday if we won't receive full payment by tomorrow evening.

13.07.2022 11:29:20 UTC
Avatar
Avatar

Hello our bosses and executive team are in contact with the bank about logistics and how much we can get, this is not something they normally do so the logistics are hard and take some time. We cannot make this happen by Friday, we are asking for more time, next week please. We are talking to you in good faith and thank you for your help so far.

14.07.2022 01:44:35 UTC

You already have spent 3 weeks. It's more than enough to check your balance and obtain cryptocurrency. The price will be raised to 30M from tomorrow.

14.07.2022 07:24:03 UTC
Avatar

Hello. Another week passed. Should we wait for payment or we may proceed to the publication of your files?

22.07.2022 12:39:57 UTC
Avatar

Are you there?

24.07.2022 16:17:29 UTC
Avatar

???

25.07.2022 11:01:05 UTC
Avatar

wtf?

28.07.2022 10:04:33 UTC
Avatar

This information is provided by Valéry Marchive