Conti Ransomware Negotiation — Redacted Organisation

Hello, please wait answer

As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website. The recovery price is $1700000 (45 BTC). If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch. The example data pack will be provided soon, which will include part of the file tree list and some actual data you can review.

30perclisting.zip [ 223kB ]

You can choose any 2 files from the listing, we will discard them as proof that the files were really stolen You can also send 2 files for a free decrypt --- Upon conclusion of the agreement, our price includes 1) Universal decryptor for your network 2) Permanently delete all stolen information + logs of removing 3) Security advisories and report how we infiltrated your system

datapack.7z [ 47.2MB ]

Have you reviewed the documents and our offer?

If we will not receive the response today we shall start transmitting your data to 3-rd parties step by step notifying your clients and employees about the breach and on how you guard their data.

You can provide two random low-value encrypted files and we will decrypt them as a proof and upload back

It took you two days to download files from review? We are not that patient and you should be more operative otherwise we will consider you stalling

Will upload the decrypted files asap.

[redacted].pdf [ 74kB ]

[redacted] Office.doc [ 533kB ]

What proof do you need? We showed that we can decrypt files Select any 2 files from the listing archive and we will discard them to you

Having received the decryptor, you can start working in 2 hours

Read about us on the Internet - we work honestly. It is much more profitable to conclude an agreement with us than to incur losses

Ok, keep me updated

hello

what file names ? Are you talking about 100% listing?

Proof of file decryption - you sent 2 files to us, we deciphered them and threw them off.

File with the title "30perclisting.zip" Here is a list of 20 - 30 percent stolen information from your network.

When you conclude an agreement, you will receive a decryptor for your entire network and return the state of computers to their previous state in a few hours

any updates?

ok, waiting.

Well, it's way more than 2 files, but we will provide.

2019_[redacted].xlsx [ 43kB ]

2019_[redacted].xlsx [ 152kB ]

Logo [redacted].pdf [ 87kB ]

[redacted].pdf [ 69kB ]

[redacted] - Employee agreement [redacted].docx [ 44kB ]

[redacted] - Employee agreement [redacted].docx [ 46kB ]

[redacted].PNG [ 83kB ]

Agreement [redacted].docx [ 42kB ]

2020 [redacted] (1).xlsx [ 21kB ]

[redacted].pdf [ 5.4MB ]

thanks

We are still waiting, but not for too long.

would you please repeat your offer, seems like your message didn't go through

I an confused, where have you sent your offer?

I don't see any relevant message within this chat

Perhaps one of your employees writes here

Send your current offer now

No, that's impossible, suppose some of your employees send the messages, maybe we should move to another chat making it private?

I will provide the new chat ID within an hour.

Ok, let's move there, should I block this chat forever?