// Ransomware Negotiation Transcript
Conti Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a Conti ransomware negotiation with a redacted victim organisation. The negotiation consisted of 32 messages exchanged.
The initial ransom demand was $1.2M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
hi, I need to decrypt my files
the ID I found on my pc is
---BEGIN ID---
[redacted]
---END ID---
can you help me ?
Hello! Can we help you, name your company and the person who communicates with us, are you authorized to negotiate?
hi, my name is [redacted] and I can negotiate with you
i'm an IT Consultant that the company call for this case
name your company?
[redacted]
sorry, in Italy it is sleeping time ....
have you any answer for us ?
hi, any news for us ?
Hi, are you online?
Hello [redacted] Group
Your network was hacked, infrastructure encrypted and we downloaded many private information from your servers.
Important!
We have instructions and follow them, they do not change.
Important!
Read carefully:
1. The BASE PRICE for decrypt and non-recoverable deletion is $1,200,000.
2. We have 14 days to negotiate! the end of the term, the BASE PRICE will be doubled & we will publish you for the purpose of selling access to your network and datas of your company.
3. But there is also a positive point in our conditions, if you pay quickly during the week, then the discount will be from the BASE PRICE of -30%.
4. The DISCOUNT PRICE (14 days from that date) will be: $840,000
5. BTC Wallet: [redacted]
6. To make sure that the decoder works, you can give us some files that do not contain important information, and we decode them to show performance.
7. As for the evidence that we have private information from your network, we can provide some of the tree files taken from you. You will select 5 files and we will provide them to you as evidence.
[redacted]_SAMPLE_TREE.zip [ 344kB ]
[REDACTED URL]
thanks for your message. your request is very high, and it is impossibile for us to have so much money.
Evaluate our offer, it is balanced and realistic, we understand your desire to reduce the costs of this incident. But let's be realistic, we have blocked all your infrastructure and threaten to publish data that in the long run + not installed infrastructure will make your losses many times the amount we ask. Let's go ahead, people who tell the management of your company that they can reduce the price - make mistakes, this will not happen. Our price is final. It will only grow. Ahead of the pullout of your data. You need to discuss this well before pulling time and then biting your elbows why the price has risen so much.
We are waiting and ready for negotiations.
I did not write to you because we want to save, but because it is a sum of money that is not possible.
we understand our problem, and thank you for answering us
with such a large sum of money our company goes bankrupt
if the company closes the data is no longer needed by anyone. we don't need them anymore, and you don't get paid if we close
we have availability for a maximum of 3 - 4 BTC, in addition we have to ask the banks for money and this is not possible in 14 days
4. The DISCOUNT PRICE (14 days from that date) will be: $840,000
[REDACTED URL]
I fully understand your position, but you too must understand that it is not possible for us to recover all this money in 14 days
please, let's try to find a meeting point
we are offering 200.000 $
What amount are you offering now? Name her $
i hope you can accept, so we can close quickly
I believe that $ 200,000 is a very important amount of money for both of us
I believe that $ 200,000 is a very important amount of money for both of us
// Analysis
Analyst Observations
- Conti was a major ransomware operation that effectively shut down in May 2022 after internal chat logs were leaked. Members dispersed to other groups including Royal, BlackBasta, and Karakurt.