// Context
About This Negotiation
This transcript documents a Conti ransomware negotiation with 20210517.
The negotiation consisted of 69 messages exchanged over Unknown.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[20210517] — 17/05/2021, 19:05:39 — Message 1/69
we received your ransom note. Can you provide the proof pack you mentioned
[Conti] — 17/05/2021, 21:35:39 — Message 2/69
Welcome! [redacted]
[20210517] — 17/05/2021, 21:37:06 — Message 3/69
Hello!
[Conti] — 17/05/2021, 21:37:07 — Message 4/69
You need pay for decrypt your files. Your price is 1.500.000$
[20210517] — 17/05/2021, 21:37:20 — Message 5/69
can you send us a proof pack
[Conti] — 17/05/2021, 21:37:29 — Message 6/69
You need to pay this amount and we will give you decryptor for all your network, file tree on what we have downloaded from your network and wiping log of that information.
You can choose not to pay and then your data will be published in the media with subsequent sale.
If you will spend 3 days in silence we will start publushing the information.
[20210517] — 17/05/2021, 21:40:55 — Message 7/69
can you let us know the amount of information that you have taken
[Conti] — 17/05/2021, 21:46:54 — Message 8/69
We have your accounting, legal documents, finance, contracts and personal correspondence, DB, that's all I can say. It's about 200 Gigabate. You will receive a complete list of files after payment as well as a log of their removal from our server.
[Conti] — 17/05/2021, 21:49:21 — Message 9/69
[redacted]_proof.7z [ 2.1MB ]
[Conti] — 17/05/2021, 21:49:38 — Message 10/69
Proof Pack. Pass: 123123
[Conti] — 17/05/2021, 21:50:39 — Message 11/69
If you delay the negotiations, on Monday we will release information about the fact of hacking your network. Further, if you do not understand this, we will publish part of the data to find a buyer for them.
[Conti] — 17/05/2021, 22:26:56 — Message 12/69
We will also try to find a buyer for your data and access to your network if you refuse to pay.
[20210517] — 18/05/2021, 20:53:35 — Message 13/69
Thanks for providing the data. We are struggling with the claim that you have 200GB of data. Can you provide further examples of the information as the random samples are not moving management.
[Conti] — 18/05/2021, 22:35:11 — Message 14/69
We will send you 30% of the file tree, you will select any 3 pcs of non-sensitive information and we will provide them to you as evidence.
[20210517] — 18/05/2021, 23:07:56 — Message 15/69
Ok
[20210517] — 19/05/2021, 17:31:19 — Message 16/69
Checking in
[Conti] — 20/05/2021, 00:03:59 — Message 17/69
Wait.
[Conti] — 20/05/2021, 00:11:40 — Message 18/69
30%_DATA_[redacted].txt.7z [ 794kB ]
[Conti] — 20/05/2021, 00:11:55 — Message 19/69
Pass: 123123
[Conti] — 20/05/2021, 22:04:04 — Message 20/69
Let's not delay the negotiations. This has a negative effect on the fact of publishing you. Be more active.
[20210517] — 20/05/2021, 23:48:37 — Message 21/69
We should have an offer to you shortly as management has been discussing.
[Conti] — 21/05/2021, 00:17:36 — Message 22/69
Make a reasonable offer based on our offer.
[20210517] — 21/05/2021, 03:24:01 — Message 23/69
Can you provide the following three files
[20210517] — 21/05/2021, 03:24:09 — Message 24/69
1../SRV[redacted]/E/[redacted]/SALES/Contractor/[redacted]/[redacted]/[redacted]\ Miscellaneous\ Control\ Equipment/5\ -\ Submittals/[redacted]/[redacted]\ Hydro\ Testing.pdf
2../SRV[redacted]/E/[redacted]/SALES/Contractor/[redacted]/1\ ARCHIVE\ -\ OLD\ PROJECTS/2006-2010\ Fiscal\ Years/[redacted]\ -\ [redacted]/[redacted]/Proposal/Complete\ Proposal_RFQ\ [redacted]_[redacted]_122106.pdf
3../SRV[redacted]/E/[redacted]/SALES/Contractor/[redacted]\ [redacted]/[redacted]\ Generating\ [redacted]\ Steam\ Bypass\ [redacted]/FW\ [redacted]\ Generating\ [redacted\ -\ Request\ for\ Proposal\ -\ Steam\ Bypass\ [redacted].msg
[Conti] — 21/05/2021, 13:51:11 — Message 25/69
[redacted]_proof1.7z [ 1.6MB ]
[Conti] — 21/05/2021, 13:52:00 — Message 26/69
Pass: 123123
[Conti] — 21/05/2021, 13:56:08 — Message 27/69
Let's not delay the negotiations. This has a negative effect on the fact of publishing you. Be more active.
[20210517] — 21/05/2021, 20:43:10 — Message 28/69
Management is requesting more time to formulate an offer. Thank you for your patience
[Conti] — 21/05/2021, 20:51:38 — Message 29/69
How long do you need? You wanted to agree quickly, but you yourself are delaying the negotiations.
[20210517] — 22/05/2021, 15:08:38 — Message 30/69
After many discussions with management, they have settled at $150K for the amount. This is based on the valuation of the information provided and other risk factors in the environment. Management hopes to settle quickly, can we agree
[Conti] — 22/05/2021, 15:49:04 — Message 31/69
Your offer has been rejected. Make a more reasonable offer based on our offer.
[Conti] — 22/05/2021, 15:51:00 — Message 32/69
150.000 and 1.500.000 why do you think we should agree to 1\10? Your proposal is not even close to what you can talk about and think about.
[20210517] — 22/05/2021, 22:29:40 — Message 33/69
We are willing to negotiate to a fair settlement. What number can you offer?
[Conti] — 23/05/2021, 19:53:19 — Message 34/69
Well, we see constructive dialogue and make a discount. Your new price is $1.350.000
[20210517] — 24/05/2021, 00:40:33 — Message 35/69
We will discuss as a management team and get back in touch shortly.
[20210517] — 24/05/2021, 15:32:39 — Message 36/69
Management has informed me that $200K is what we can offer. Hopefully we can get this to closure.
[Conti] — 24/05/2021, 21:10:43 — Message 37/69
Well, we see constructive dialogue and make a discount. Your new price is $1.300.000
[Conti] — 25/05/2021, 17:22:22 — Message 38/69
do you delay negotiations, do you have constructive proposals?
[20210517] — 26/05/2021, 17:49:21 — Message 39/69
Based on the valuation of the data, we are at $200K. We hope you will be able to accept your offer
[Conti] — 27/05/2021, 17:02:06 — Message 40/69
Well, we see constructive dialogue and make a discount. Your new price is $900.000. Your next step.
[Conti] — 27/05/2021, 17:03:22 — Message 41/69
Evaluate our steps. You can negotiate with us. But offering funny amounts is not the best way for you. It leads to publication.
[20210517] — 27/05/2021, 20:53:26 — Message 42/69
Let me talk with my bosses
[Conti] — 29/05/2021, 22:27:15 — Message 43/69
do you delay negotiations, do you have constructive proposals?
[20210517] — 01/06/2021, 17:39:48 — Message 44/69
My bosses have told me $225K is all we can do. Hopefully we can agree on this one.
[Conti] — 01/06/2021, 22:25:36 — Message 45/69
Well, we see constructive dialogue and make a discount. Your new price is $875.000. Your next step.
[20210517] — 03/06/2021, 16:11:52 — Message 46/69
Management has informed me that $250K is the highest we can go to settle our affairs. They also have informed me that while the decryption key would be nice, they do not need it.
[Conti] — 03/06/2021, 20:16:00 — Message 47/69
Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.
[20210517] — 05/06/2021, 00:25:11 — Message 48/69
$250K is all we can offer.
[Conti] — 05/06/2021, 00:44:50 — Message 49/69
Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.
[Conti] — 07/06/2021, 01:12:34 — Message 50/69
Do not delay the negotiations, this will negatively affect the publication.
[20210517] — 07/06/2021, 16:06:17 — Message 51/69
My bosses have told me $250K is all we can do.
[Conti] — 07/06/2021, 20:54:56 — Message 52/69
Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.
[Conti] — 07/06/2021, 20:55:03 — Message 53/69
Do not delay the negotiations, this will negatively affect the publication.
[20210517] — 07/06/2021, 21:06:17 — Message 54/69
I have given you the best offer I can. I wish I could do more.
[Conti] — 12/06/2021, 01:30:38 — Message 55/69
If we don't agree by Tuesday, publications will begin Wednesday. All deadlines are out. Your tactics will lead to a deplorable result for you.
[Conti] — 12/06/2021, 01:30:50 — Message 56/69
Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.
[Conti] — 14/06/2021, 20:31:41 — Message 57/69
Publications will begin Wednesday. All deadlines are out. Your tactics will lead to a deplorable result for you.
[20210517] — 15/06/2021, 06:24:09 — Message 58/69
$250K is the best offer. Hopefully we can agree to settle our affairs.
[Conti] — 15/06/2021, 12:00:44 — Message 59/69
Publications will begin Wednesday. All deadlines are out. Your tactics will lead to a deplorable result for you.
[Conti] — 16/06/2021, 20:03:41 — Message 60/69
Look, we discussed everything and decided. The minimum we can agree to in your case is $350,000. Either we make a deal or we publish you. There's no time to pull conversations.
[20210517] — 16/06/2021, 21:24:38 — Message 61/69
Let me talk with my boss
[20210517] — 17/06/2021, 18:13:54 — Message 62/69
Can you send us the wallet
[20210517] — 17/06/2021, 23:15:30 — Message 63/69
to confirm, we will receive the decryptor, the data (file tree), shred log, not to be posted, and a security report. We are waiting on the wallet upon your confirmation
[20210517] — 18/06/2021, 04:16:51 — Message 64/69
we are ready to move forward once confirmed
[Conti] — 18/06/2021, 10:08:54 — Message 65/69
Correct. The wallet for the payment is:
[redacted]
[20210517] — 19/06/2021, 07:14:37 — Message 66/69
The wallet has been funded
[20210517] — 19/06/2021, 07:14:46 — Message 67/69
[REDACTED URL]
[Conti] — 19/06/2021, 09:24:55 — Message 68/69
[redacted]_decryptor.exe [ 103kB ]
[Conti] — 19/06/2021, 09:25:07 — Message 69/69
Decryptor:
1) Launch the decryptor under Administrative rights
2) Wait till the decryptor window is closed
3) if any of the files haven't changed the extension back to the original - repeat 1 and 2