// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 17 messages exchanged over 1 days, beginning on 2022-07-26.
The initial ransom demand was $1.0M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — 26.07.2022 16:05:41 UTC — Message 1/17
[Chat started]
[lockbit3.0] — 26.07.2022 16:27:56 UTC — Message 2/17
hello
[lockbit3.0] — 26.07.2022 16:28:28 UTC — Message 3/17
Are you ready to negotiate?
[lockbit3.0] — 26.07.2022 16:42:56 UTC — Message 4/17
Price decrypt 3 000 000$
[Victim] — 27.07.2022 15:19:16 UTC — Message 5/17
Hello
[Victim] — 27.07.2022 15:23:55 UTC — Message 6/17
are you here ?
[lockbit3.0] — 27.07.2022 15:24:14 UTC — Message 7/17
yes
[lockbit3.0] — 27.07.2022 15:24:38 UTC — Message 8/17
we wait your answer and your offers
[Victim] — 27.07.2022 15:25:50 UTC — Message 9/17
3 000 000$ is too much whats your best offer ?
[lockbit3.0] — 27.07.2022 15:26:49 UTC — Message 10/17
well, given that your network was not completely infected, we can drop the price to 1,000,000
[lockbit3.0] — 27.07.2022 15:27:34 UTC — Message 11/17
Also keep in mind that we have stolen your data and can publish it at any time
[lockbit3.0] — 27.07.2022 15:27:49 UTC — Message 12/17
[REDACTED URL]
[lockbit3.0] — 27.07.2022 15:28:37 UTC — Message 13/17
We offer you to decrypt all your files as well as files of your hypervisors for 1 million
[lockbit3.0] — 27.07.2022 15:29:12 UTC — Message 14/17
You are a fairly large company and it will not be a problem for you to collect such an amount
[lockbit3.0] — 27.07.2022 15:33:02 UTC — Message 15/17
[redacted] - BTC Wallet
[lockbit3.0] — 27.07.2022 15:34:38 UTC — Message 16/17
It's up to you to pay or not, we also backed up your SQL databases before overwriting and encrypting them so they're safe
[lockbit3.0] — 27.07.2022 15:37:59 UTC — Message 17/17
ur offer is that you make a payment of exactly $ 1,000,000 and we give you a full set of decoders for both ESXi and the Windows family