Conti Ransomware Negotiation — Redacted Organisation

// Primary Source

Full Transcript — Verbatim

Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.

Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.

[Victim] — 1/7/2021, 9:58:18 PM — Message 1/139

[redacted]: Please contact me as soon as possible. [redacted]@gmail.com

[Victim] — 1/7/2021, 10:17:21 PM — Message 2/139

[redacted]: readme.txt [ 866B ]

[Conti] — 1/7/2021, 10:20:01 PM — Message 3/139

Support: Hi. Could you introduce yourself?

[Victim] — 1/7/2021, 10:20:44 PM — Message 4/139

[redacted]: My name is [redacted] and I got a message to contact you in regards to an encryption on my computer.

[Victim] — 1/7/2021, 10:28:29 PM — Message 5/139

[redacted]: are you the person I need to contact to help me? I sent my email and name to you as you asked.

[Conti] — 1/7/2021, 10:37:50 PM — Message 6/139

Support: Your network was ATTACKED, your computers and servers were LOCKED. Take into consideration that we have also downloaded data from your network that in case of not making payment will be published on our news website. After the payment you will get decryptor to all your systems, full file tree of downloaded data, non-recoverable deletion with proof log and security report on how you were hacked. We downloaded all employees private info, company's financial documents and etc. In case of not making payment will be also published. More than terabyte of private information has been downloaded from your servers. Including financial data of your company, personal data of your employees and their family members, company agreements, and most importantly.

[Victim] — 1/7/2021, 10:40:30 PM — Message 7/139

[redacted]: What do I need to do?

[Conti] — 1/7/2021, 10:43:31 PM — Message 8/139

Support: Overall price is $900,000. For this price you will get everything mentioned above. Please pass this information on to your management. In the future, we are ready to communicate only with the representative who can make such decisions. We are ready to provide you with a small set of files from different servers of your company.

[Victim] — 1/7/2021, 11:03:50 PM — Message 9/139

[redacted]: I am authorized to speak on behalf of the company. Are you the person who sets this price for regaining access to everything?

[Victim] — 1/7/2021, 11:46:28 PM — Message 10/139

[redacted]: hello, are you still there?

[Victim] — 1/8/2021, 1:50:15 AM — Message 11/139

[redacted]: Is there anyone there? Please at least email me at [redacted]@gmail.com so I can continue to work through this with you.

[Conti] — 1/8/2021, 2:41:32 PM — Message 12/139

Support: We are here.

[Conti] — 1/8/2021, 2:41:45 PM — Message 13/139

Support: Are you ready to transfer money?

[Victim] — 1/8/2021, 5:27:46 PM — Message 14/139

[redacted]: Yes. I would like to fix the problem but I don't have this amount of money. Please tell me how we can resolve.

[Conti] — 1/8/2021, 5:37:26 PM — Message 15/139

Support: According to the public records your revenue is [more than 30],000,000$, so this price is reasonable. [REDACTED URL] Also you should remember that the price is much cheaper then you will pay lawsuits, that your clients will send you and government fines, because you have lost so much of their data.

[Victim] — 1/8/2021, 7:09:42 PM — Message 16/139

[redacted]: We would like to fix this problem but we have been out of service during Covid and do not have this amount of money. I am trying to fix and please let me know what we can do.

[Conti] — 1/8/2021, 7:12:28 PM — Message 17/139

Support: What is your best proposal?

[Victim] — 1/8/2021, 7:40:16 PM — Message 18/139

[redacted]: I have the ability to send 20,000 as soon as I can transfer money. I would like to get this fixed and please let me know if we can get this fixed.

[Victim] — 1/8/2021, 7:41:25 PM — Message 19/139

[redacted]: How can we test to see if this can be fixed?

[Conti] — 1/8/2021, 8:04:33 PM — Message 20/139

Support: We could not accept that offer, but we could reduce the price and give you the new one 800,000$. We could decrypt 1-2 files as samples.

[Victim] — 1/9/2021, 6:56:50 PM — Message 21/139

[redacted]: [redacted].docx.[redacted] [ 15kB ]

[Victim] — 1/9/2021, 6:57:02 PM — Message 22/139

[redacted]: [redacted].docx.[redacted] [ 13kB ]

[Victim] — 1/9/2021, 6:57:23 PM — Message 23/139

[redacted]: Here are two samples. Can you open them?

[Conti] — 1/10/2021, 2:58:04 PM — Message 24/139

Support: Yes. But today is weekend and we will decrypt them tomorrow.

[Victim] — 1/10/2021, 5:50:21 PM — Message 25/139

[redacted]: We we are not comfortable paying until you are able to decrypt these samples. Did you take data from us as well? We have a small window of time where buying your keys is useful as we are working on a rebuild. We have a meeting early tomorrow morning, so I will ask you send us: 1) your nest offer, 2 proof that you can decrypt, 3 proof of whatever you claim you stole. $800,000 is still an insane price for us, so if you want us to even consider this, please be realistic. Please send us #1, #2 and #3 as soon as you can. Thank you.

[Victim] — 1/11/2021, 5:07:22 AM — Message 26/139

[redacted]: Are you there? Can you decrypt my files? What files did you take? I'm willing to pay you very quickly to unlock my files, but $800k is impossible. If you can prove these things and offer a realistic price, I'll pay you right away. Thank you.

[Conti] — 1/11/2021, 3:54:31 PM — Message 27/139

Support: Yes. We are here and provide samples very shortly.

[Conti] — 1/11/2021, 3:55:13 PM — Message 28/139

Support: The price is more then realistic for company with so revenue. What is your best proposal?

[Conti] — 1/11/2021, 4:07:33 PM — Message 29/139

Support: [redacted].docx [ 12kB ]

[Conti] — 1/11/2021, 4:07:39 PM — Message 30/139

Support: [redacted].docx [ 15kB ]

[Victim] — 1/11/2021, 4:08:24 PM — Message 31/139

[redacted]: Thank you. I'm waiting for information about what files you took. Regarding our revenue, if this happened last year at this time, paying this much wouldn't have been a problem. But with the pandemic and financial crisis, people just aren't buying cars. We have a large inventory that isn't selling and by holding onto this inventory like we are, we're actually losing more money than making money. It will take us months to crawl out of this problem to start making a profit. Revenue is not profit, as you know.

[Conti] — 1/11/2021, 4:14:15 PM — Message 32/139

Support: The static shows opposite. A lot of sources say that people start to buy cars more, because of pandemic. Anyway what is your best proposal?

[Victim] — 1/11/2021, 4:18:51 PM — Message 33/139

[redacted]: The boss is meeting his financial advisor to find out how much we can afford to pay. I'll let you know. In the meantime, since you say you took files from us, are you able to show us?

[Conti] — 1/11/2021, 4:26:30 PM — Message 34/139

Support: Yes. We could forward you several samples.

[Victim] — 1/11/2021, 4:28:31 PM — Message 35/139

[redacted]: Thanks. If the price is something we can afford and we can pay, what do we get?

[Conti] — 1/11/2021, 4:41:00 PM — Message 36/139

Support: We wrote you previously. We will give you decrypt tool for all your machines, security report on how you were hacked, file tree on what we have downloaded from your network and wiping log of that information.

[Conti] — 1/11/2021, 5:38:17 PM — Message 37/139

Support: Here is several samples: [REDACTED URL] [REDACTED URL] pass [redacted]

[Victim] — 1/11/2021, 5:46:39 PM — Message 38/139

[redacted]: Thanks. Is this all you took?

[Conti] — 1/11/2021, 5:51:39 PM — Message 39/139

Support: NO. We took much more, around 1 terabyte. We wrote that previously too, including the data of clients and employees.

[Victim] — 1/11/2021, 6:57:32 PM — Message 40/139

[redacted]: What computers did you take files from? 1 tb is a lot of files. Why only 7 files as proof?

[Conti] — 1/11/2021, 7:07:31 PM — Message 41/139

Support: It is more then enough. You should understand that downloading data is very easy process when you have an access to the whole system.

[Victim] — 1/11/2021, 7:10:35 PM — Message 42/139

[redacted]: Can you let me know what computers files came from? Or provide a list of files?

[Conti] — 1/11/2021, 7:32:11 PM — Message 43/139

Support: It is impossible to make so big list. We will try to make a list of servers and desktops.

[Conti] — 1/11/2021, 7:42:10 PM — Message 44/139

Support: [redacted].[redacted].local [redacted]ToyDC01.[redacted].local [redacted]GMCDC01.[redacted].local [redacted]oloDC01.[redacted].local [redacted]HonDC01.[redacted].local [redacted]ingDC01.[redacted].local [redacted]MazDC01.[redacted].local [redacted]aprdc01.[redacted].local [redacted]lbqDC01.[redacted].local [redacted]IFP.[redacted].local [redacted]oloHV01.[redacted].local [redacted]oloAPP01.[redacted].local [redacted]oloEX02.[redacted].local [redacted]ways.[redacted].local

[Victim] — 1/11/2021, 7:51:27 PM — Message 45/139

[redacted]: Are these the computers you took files from?

[Conti] — 1/11/2021, 7:56:15 PM — Message 46/139

Support: NO. That is just a list of servers. We did not make a list of desktops, we usually took from all.

[Victim] — 1/11/2021, 7:58:26 PM — Message 47/139

[redacted]: Okay. Of all these 1 TB of files you took, you can only show me 7 files?

[Victim] — 1/12/2021, 4:05:08 PM — Message 48/139

[redacted]: We're working on how much we can afford to pay you, but my boss is asking for some more information. Are you able to send some more files? 7 files is a tiny amount when you say you took 1 TB.

[Conti] — 1/12/2021, 5:43:18 PM — Message 49/139

Support: Here is several more files: Download: [REDACTED URL] Delete: [REDACTED URL]&q=[redacted] pass [redacted]

[Victim] — 1/13/2021, 4:28:44 AM — Message 50/139

[redacted]: We reviewed the financials and we can pay you $72,380, but only if you promise to make all our files open and usable again and give back all the files you took.

[Conti] — 1/13/2021, 9:35:25 AM — Message 51/139

Support: That is not enough. We could reduce the price and give you a new offer 700,000$. You should remember that the price is much cheaper then you will pay lawsuits, that your clients will send you and government fines, because you have lost so much of their data(Ids, ssn, credit cards).

[Victim] — 1/13/2021, 1:54:23 PM — Message 52/139

[redacted]: I can see why you would think that. In reality, regardless if the files you took end up on your news site or not, I still have the same legal requirements and exposure. This was the case the second the files were taken, not if the files get posted or not. I have already begun the notifications to everyone whose data was affected, so it doesn't matter if the files are posted or not. Now, would I prefer the files not be posted, of course I would. Only because I care about my employees and my customers.

[Victim] — 1/13/2021, 1:54:55 PM — Message 53/139

[redacted]: You need to understand that the reason I'm here is to get my files unlocked. I'm already taking a huge financial hit taking care of the legal notifications and the fees associated with that. I just want my files back and unlocked.

[Victim] — 1/13/2021, 1:55:58 PM — Message 54/139

[redacted]: I spent all weekend with my finance guy reviewing the accounts and savings and were able to pull together $72,380. Business has not been good during the past year and what you're asking for is impossible. With COVID and the financial crisis, many people are out of work and aren't making large purchases. The people who are lucky enough to still have jobs are working from home and aren't buying new cars. I know you are the only person who can unlock the files, so this is why I'm willing to pay you the $72,380 that I have left. You can understand my situation, right?

[Conti] — 1/13/2021, 2:04:37 PM — Message 55/139

Support: We don't think, that our estimates are incorrect. Your financial reports are somewhat more reliable, than your word here and now. And your proposal here is just from the textbooks - ten times less, than our initial demand. It seems, that you do not understand, how works our group. We don't ask $20 millions, to receive our demand of $750,000.So you should understand, that our team have plenty of projects running, and yours - just one from many. If we don't reach an agreement, we'll just shorten our profit.

[Conti] — 1/13/2021, 2:06:02 PM — Message 56/139

Support: Also, your notifications will not save private data of your employees and customers, it will be used long time in many bad purposes. Think about your reputation, which will be damaged in so hard times for business.

[Victim] — 1/13/2021, 2:28:53 PM — Message 57/139

[redacted]: I understand what you're saying and know you are a famous group. I have Googled you and know you are professionals. I know you do this all the time, but please put yourself in my shoes for a moment. There is nothing textbook about this. Nobody saw this pandemic and financial crisis coming. I had no idea that 2020 was going to be as bad as it was. I still have inventory on my lot from 13 months ago. That's unheard of in my business! I'm hoping 2021 turns around and is better, but until then, I'm just trying to survive. Car dealerships are very low margin, meaning that if I'm able to sell a few cars, the revenue doesn't necessarily cover my bills or employee salaries. I need to sell a certain level of inventory to make a profit and most months I didn't. I've had to furlough employees just to try to keep the dealership open. I'm willing to do whatever it takes and to work with you for as long as it takes, but I only have $72,380 that I can pay you to unlock my files.

[Conti] — 1/13/2021, 2:32:27 PM — Message 58/139

Support: Of course, we understand, that your work here is not easy and requires efforts to convince your board members. But we are still far from agreement. Our estimates are still much higher, than your proposal. We hope, that you will give us better price. And since it is our mutual interest to speed up our negotiations as much, as we can - take more serious steps toward us. It would be much easier than for us to make steps to you in response.

[Victim] — 1/13/2021, 5:10:40 PM — Message 59/139

[redacted]: I want to get you your money to get my files back. I know you put time and effort into this and want to get paid. We both want the same thing here. You see this, right? The only obstacle that I have that I need your help with is the high price. I just don't have that much. I worked to get $72,380 from my accounts to pay you.

[Conti] — 1/13/2021, 5:45:36 PM — Message 60/139

Support: That is not enough. There is many ways how you could get additional funds. You could apply on the loan in the bank or take out your savings or cut expenses or sell something and etc. You are just wasting time now.

[Victim] — 1/13/2021, 6:10:51 PM — Message 61/139

[redacted]: I don't understand why the price is so high. You obviously know what my financial situation is and know that I can't possibly afford to pay you this much. For a bank to give me a loan, they'll examine my current situation, look at my debt to income ratio and see if I'm actually profitable. I already know what they're going to tell me. I'm too risky. Can't we skip all of this time wasting and let me pay you?

[Conti] — 1/13/2021, 6:12:42 PM — Message 62/139

Support: OK. We could reduce the price and offer the new amount 500,000$. The price is more then reasonable for that data and your reputation.

[Victim] — 1/14/2021, 2:33:42 AM — Message 63/139

[redacted]: How is asking for over $400k more than what I can afford to pay you help our situation?

[Conti] — 1/14/2021, 9:40:32 AM — Message 64/139

Support: We told you above that there is several ways to find additional funds.

[Victim] — 1/14/2021, 2:50:34 PM — Message 65/139

[redacted]: I'm meeting with a loan officer at the bank today.

[Conti] — 1/14/2021, 4:49:44 PM — Message 66/139

Support: Keep updating us please.

[Victim] — 1/14/2021, 7:39:42 PM — Message 67/139

[redacted]: Good news. We were approved for a loan for the amount of $45,500. This makes the total amount that I can pay you $117,880. I requested $400k, but due to my debt-to-income ratio and current liabilities, $45,500 is the most they could approve for me. I have contact other lending firms and they all tell me that's the most I can be approved for, based on my credit and current financials.

[Victim] — 1/14/2021, 7:40:24 PM — Message 68/139

[redacted]: We've been at this over a week now. We both want the same thing, a payment to get data back. I've done all I can at this point. Please, can we agree so I can pay you? This is why you did this, right?

[Conti] — 1/14/2021, 8:53:19 PM — Message 69/139

Support: We need some time to discuss this offer.

[Victim] — 1/14/2021, 8:57:44 PM — Message 70/139

[redacted]: This is a long holiday weekend and if I can't pay soon, I won't be able to until mid-next week.

[Conti] — 1/14/2021, 9:52:12 PM — Message 71/139

Support: We could the offer today but it should be more profitable. We could give you some more discount and offer new price 400,000$.

[Victim] — 1/14/2021, 10:03:01 PM — Message 72/139

[redacted]: I don't understand. I've pulled all the cash from out of the business and I put my neck out on the line for a loan to come up with $117,880. I don't have any other options. $400k is impossible for me. I can pay you $117,880 right away. It will take weeks or months before I can pay anything close to $400k.

[Victim] — 1/14/2021, 10:34:59 PM — Message 73/139

[redacted]: Are you there? Please let me know if I can pay you $117,880. I understand that you want to make good money for your work, but this is as much as I can possible pay. I can't get another loan.

[Conti] — 1/15/2021, 2:21:25 PM — Message 74/139

Support: We looked throw your finance records, bank accounts and know that you have more available funds. We are ready to give you some discount, but that price is not reasonable. We own a lot of private data which cost much more.

[Victim] — 1/15/2021, 4:03:24 PM — Message 75/139

[redacted]: I had to meet with a loan advisor to get more funds to pay you. I want to fix this problem and work with you but I can't afford anymore then $117,880. This is all I have. We have been out of service during Covid and I can't come up with anymore money.

[Conti] — 1/15/2021, 4:37:38 PM — Message 76/139

Support: You have more funds on your accounts.

[Conti] — 1/15/2021, 5:11:18 PM — Message 77/139

Support: We are ready to accept 200,000$.

[Conti] — 1/15/2021, 8:54:27 PM — Message 78/139

Support: Are you ready to pay?

[Victim] — 1/16/2021, 8:56:24 PM — Message 79/139

[redacted]: I need to meet with the bank to see what my options are and how much more I can borrow. Monday is a federal holiday and the bank is closed. I'll meet with them first thing in the morning on Tuesday and I'll let you know.

[Victim] — 1/16/2021, 8:56:46 PM — Message 80/139

[redacted]: How do I pay you? Would the bank pay you?

[Conti] — 1/18/2021, 8:39:35 AM — Message 81/139

Support: We accept only bitcoins.

[Victim] — 1/18/2021, 3:44:26 PM — Message 82/139

[redacted]: Okay I'll start looking into bitcoin as well. I'll have an update tomorrow

[Conti] — 1/18/2021, 4:13:13 PM — Message 83/139

Support: There is several ways how you could exchange funds. You should check google and choose the most convenient for you.

[Victim] — 1/19/2021, 3:09:30 PM — Message 84/139

[redacted]: I found a good bitcoin site. I have a call with the bank in a little bit and I'll let you know how it goes.

[Conti] — 1/19/2021, 3:13:24 PM — Message 85/139

Support: OK. Keep updating us please.

[Victim] — 1/19/2021, 4:05:11 PM — Message 86/139

[redacted]: It took some convincing, but I was able to get a $27,000 addendum to my previous loan. With the total loan amount of $72,500 and everything from my accounts, I can pay you $144,880. I have a bitcoin wallet account all set up and ready to use.

[Conti] — 1/19/2021, 4:16:58 PM — Message 87/139

Support: We reduce price as much as we can. We totally sure that you had sales during this time, so you have sources from where you could add funds.

[Victim] — 1/19/2021, 4:20:21 PM — Message 88/139

[redacted]: There have been no sales since this attack. You have locked up all the computers, leaving me not able to operate at all. This is why I've been working on getting a loan and begging and borrowing money from anyone I can.

[Conti] — 1/19/2021, 4:29:44 PM — Message 89/139

Support: We went as low as we could. The price is little more then 20% from starting amount. It is very huge discount, especially if we remind that we own a lot of valued documents, credit cards and etc. We could not cut our profit anymore.

[Conti] — 1/19/2021, 4:37:32 PM — Message 90/139

Support: I made a request to my managers about additional discount anyway.

[Victim] — 1/19/2021, 4:41:59 PM — Message 91/139

[redacted]: Thank you. I really want to pay you to get my computers unlocked.

[Conti] — 1/19/2021, 4:51:53 PM — Message 92/139

Support: We understand that and that's why we gave you so huge discount. We do not have purpose to ruin your business.

[Victim] — 1/19/2021, 5:00:46 PM — Message 93/139

[redacted]: I understand. We both want the same thing. We both want a payment so I can get my files back. I'm short $55k and have no other options.

[Conti] — 1/19/2021, 5:28:39 PM — Message 94/139

Support: We are ready to reduce a little more a price. The new offer is $185,00.

[Victim] — 1/19/2021, 5:50:16 PM — Message 95/139

[redacted]: Okay, thank you. I'll need more time to find the funds. In addition to getting my files unlocked, what else does a payment get me?

[Conti] — 1/19/2021, 7:05:45 PM — Message 96/139

Support: We will return all your data and provide security report.

[Victim] — 1/19/2021, 10:52:26 PM — Message 97/139

[redacted]: What about the files you took? You will give that back as well? How does that work? Will you be able to provide proof that you deleted all the files?

[Conti] — 1/20/2021, 2:11:45 PM — Message 98/139

Support: We will give you all files and delete them from the cloud. It is not a problem. We never treat clients who paid us, we play only fear games.

[Victim] — 1/20/2021, 5:55:49 PM — Message 99/139

[redacted]: I'm trying today to collect more money for you.

[Conti] — 1/20/2021, 7:14:51 PM — Message 100/139

Support: OK. Keep updating us please

[Victim] — 1/20/2021, 11:43:15 PM — Message 101/139

[redacted]: I'm sorry to say this, but I still only have $144,880. I'm short a little more than $55k. The bank refuses to lend me more. I tried a couple special financing companies, but after running my credit, refuse to lend me any funds. I've asked friends and family and all are hurting more than me and can't help. I just don't know what to do now.

[Conti] — 1/21/2021, 10:42:26 AM — Message 102/139

Support: OK. So we could split the payback. You pay us what you have now and we provide you the decrypt tool. After you pay the rest, we provide your data back.

[Victim] — 1/21/2021, 3:32:34 PM — Message 103/139

[redacted]: I don't feel comfortable splitting up the payments. I rather pay you once and be done forever.

[Victim] — 1/21/2021, 3:34:42 PM — Message 104/139

[redacted]: I know you must do this all day, but I just don't see how $144,880 isn't enough to unlock my files.

[Conti] — 1/21/2021, 3:50:03 PM — Message 105/139

Support: It is not enough compare to your revenue and data which we got from you. So you could use this option and pay in two steps. You could start to work properly even today and find the rest very fast.

[Victim] — 1/21/2021, 3:57:43 PM — Message 106/139

[redacted]: I'll need more time to collect more money. I don't have a lot of options left. The business is closed down because of this attack. I'll see what I can do. If I can't pay, can I come back here in a couple of month when I have the money? Will you still be here?

[Conti] — 1/21/2021, 4:08:56 PM — Message 107/139

Support: We could not wait also. Why could you just split the payback and start to work today?

[Victim] — 1/21/2021, 4:15:41 PM — Message 108/139

[redacted]: Because I'm scarred to death about paying all I have today and this still going on. No offense to you at all when I say this, but this has been the worst experience of my life. All I want is for this to be over. The stress and anxiety has been unbearable.

[Conti] — 1/21/2021, 4:27:53 PM — Message 109/139

Support: We understand that and this is a reason why we gave so huge discount and offer you to split the payment. It is good option for you. The company will start to work today and you could earn the little rest very fast.

[Victim] — 1/21/2021, 4:33:10 PM — Message 110/139

[redacted]: I'm working on collecting more money for you today.

[Victim] — 1/21/2021, 7:58:48 PM — Message 111/139

[redacted]: Okay, I got $162,792. This is from an extra $17,912. $9,500 was from a personal loan, $3,655 is from personal savings and $4,757 is from a collection the workers did. This puts me at $162,792 that I can pay you. I literally have nothing else to give. I owe a huge debt of gratitude to my workers for their help and need to pay them back ASAP. I have a bitcoin wallet account ready, all I need to do is transfer the funds from the bank. Please let me know.

[Conti] — 1/21/2021, 8:06:45 PM — Message 112/139

Support: OK. We could accept that price. Here is the wallet: [redacted]

[Victim] — 1/21/2021, 9:10:55 PM — Message 113/139

[redacted]: Thank you. I'm working on getting the money transferred from my bank to the bitcoin account.

[Victim] — 1/21/2021, 9:12:09 PM — Message 114/139

[redacted]: After I pay, you will give me a tool to unlock all my files, right? You will also give back all the files you took, prove you deleted them and give me information about how you got in so I can make sure this doesn't happen again?

[Conti] — 1/21/2021, 9:14:02 PM — Message 115/139

Support: That is correct. As soon as we receive payment we provide required info.

[Conti] — 1/22/2021, 2:23:32 PM — Message 116/139

Support: How is it going so far?

[Conti] — 1/22/2021, 5:47:09 PM — Message 117/139

Support: When do you expect to proceed with the payment?

[Conti] — 1/22/2021, 10:09:55 PM — Message 118/139

Support: You should confirm the wallet before transfer.

[Victim] — 1/23/2021, 1:16:17 AM — Message 119/139

[redacted]: Hi. I had trouble with my bank. They didn't allow me to transfer the funds to a my bitcoin wallet because they suspected fraud. I got it cleared up and the wire has started, but it hasn't arrived yet. Because it didn't arrive today, it won't arrive until Monday morning. Is this okay??? Before I transfer the money to you, I will reconfirm your wallet.

[Conti] — 1/24/2021, 6:12:43 PM — Message 120/139

Support: OK. Keep updating us please.

[Victim] — 1/25/2021, 3:38:51 PM — Message 121/139

[redacted]: All ready to send you $162,792. Is your BTC wallet still [redacted]? If it changed, please let me know.

[Conti] — 1/25/2021, 4:16:23 PM — Message 122/139

Support: Here is the new wallet: [redacted]

[Victim] — 1/25/2021, 4:18:47 PM — Message 123/139

[redacted]: Okay, sending $162,792 to [redacted]

[Victim] — 1/25/2021, 4:22:19 PM — Message 124/139

[redacted]: Just confirming, [redacted]. You said it's new, but it's the same one you provided last week. It's still the correct wallet?

[Conti] — 1/25/2021, 4:30:49 PM — Message 125/139

Support: That is correct.

[Conti] — 1/25/2021, 5:50:09 PM — Message 126/139

Support: Did you make a transfer?

[Victim] — 1/25/2021, 6:24:16 PM — Message 127/139

[redacted]: Yes

[Victim] — 1/25/2021, 6:29:06 PM — Message 128/139

[redacted]: [REDACTED URL]

[Victim] — 1/25/2021, 6:55:03 PM — Message 129/139

[redacted]: Do you see the payment?

[Conti] — 1/25/2021, 6:57:32 PM — Message 130/139

Support: We received payment and provide required info shortly.

[Victim] — 1/25/2021, 6:57:56 PM — Message 131/139

[redacted]: Thanks

[Conti] — 1/25/2021, 7:34:37 PM — Message 132/139

Support: 1. The decryption tool uploaded to the cloud. You should launch it with administrator rights and wait until it finishes decryption process. Download: [REDACTED URL] Delete: [REDACTED URL]&q=[redacted]

[Conti] — 1/25/2021, 7:37:18 PM — Message 133/139

Support: 2. Here is the web links on your data: pass: [redacted] Download: [REDACTED URL] Delete: [REDACTED URL]&q=[redacted] [REDACTED URL] [REDACTED URL] Download: [REDACTED URL] Delete: [REDACTED URL]&q=[redacted] [REDACTED URL] [REDACTED URL] [REDACTED URL] [REDACTED URL]

[Victim] — 1/25/2021, 8:01:17 PM — Message 134/139

[redacted]: 1.rar, [redacted].rar and [redacted]2.rar are empty. Can you send via sendspace?

[Victim] — 1/25/2021, 8:02:10 PM — Message 135/139

[redacted]: 1.rar has the decryption tool in it. It's not opening. Please resend via sendspace. Thank you!

[Victim] — 1/25/2021, 8:37:22 PM — Message 136/139

[redacted]: What is the password for 1.rar? (the decryption tool)

[Conti] — 1/25/2021, 8:56:33 PM — Message 137/139

Support: Here is password: [redacted]

[Victim] — 1/25/2021, 8:58:46 PM — Message 138/139

[redacted]: Thank you! [redacted].rar and [redacted]2.rar are empty. Can you send via sendspace?

[Victim] — 1/26/2021, 3:38:07 AM — Message 139/139

[redacted]: Hello? Two of the .rar files you sent via qaz.com were ZERO bytes. Please resend [redacted].rar and [redacted]2.rar via sendspace. Thank you

Conti Ransomware Negotiation — Redacted Organisation

About This Negotiation

Full Transcript — Verbatim

Analyst Observations

Facing a Ransomware Demand?