// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Kaycan.
The negotiation consisted of 94 messages exchanged over 12 days, beginning on 2023-03-06.
The initial ransom demand was $8.0M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Kaycan] — 06.03.2023 04:48:57 UTC — Message 1/94
[Chat started]
[Kaycan] — 06.03.2023 04:54:05 UTC — Message 2/94
hello?
[lockbit3.0] — 06.03.2023 06:45:33 UTC — Message 3/94
Hello
[lockbit3.0] — 06.03.2023 13:22:04 UTC — Message 4/94
if you want decrypt, you'd better start a dialogue
[Kaycan] — 06.03.2023 15:20:07 UTC — Message 5/94
OK. I read you took files and that you have a decryptor to decrypt files. What are these files and how do I know you can decrypt the files you left?
[lockbit3.0] — 06.03.2023 15:58:15 UTC — Message 6/94
Send me some encrypted files, I will decrypt them for free.
[lockbit3.0] — 06.03.2023 21:16:45 UTC — Message 7/94
I see you're not in rush having business with us. I don't think it's in your interest to be penalized for that.
[lockbit3.0] — 08.03.2023 12:54:28 UTC — Message 8/94
If you keep quiet I will start to leak your data
[Kaycan] — 08.03.2023 13:54:35 UTC — Message 9/94
It take time to collect files wait please
[Kaycan] — 08.03.2023 13:57:45 UTC — Message 10/94
File: [Laval encrypted files.zip]
[Kaycan] — 08.03.2023 13:59:45 UTC — Message 11/94
File: [Sayabec encrypted files.zip]
[Kaycan] — 08.03.2023 14:00:06 UTC — Message 12/94
Can you show me the files you took and what your demands are?
[Kaycan] — 08.03.2023 14:00:21 UTC — Message 13/94
I uploaded some test files
[lockbit3.0] — 08.03.2023 14:17:56 UTC — Message 14/94
wait for test decrypt
[lockbit3.0] — 08.03.2023 14:18:19 UTC — Message 15/94
i'll provide you some proofs of stolen data soon
[lockbit3.0] — 08.03.2023 14:22:12 UTC — Message 16/94
vm files are not allowed for test decrypt, just not important files like .log file
[lockbit3.0] — 08.03.2023 14:25:07 UTC — Message 17/94
while i'm preparing proof for you let's talk about business
[lockbit3.0] — 08.03.2023 14:26:30 UTC — Message 18/94
you need to pay 8 million doolars to get decription software and deleating stolen data
[Kaycan] — 08.03.2023 14:33:47 UTC — Message 19/94
That is a lot of money, so we need to see what data you took to assess what the business is able to discuss.
[Kaycan] — 08.03.2023 14:34:47 UTC — Message 20/94
all files I gave you are low value. I would not send you anything important but we do want to ensure VM files would be able to decrypt
[lockbit3.0] — 08.03.2023 14:34:47 UTC — Message 21/94
it's a good price for your company
[Kaycan] — 08.03.2023 14:35:50 UTC — Message 22/94
We can certainly discuss what is a good price and how we can be assured of agreement.
[lockbit3.0] — 08.03.2023 14:36:50 UTC — Message 23/94
decryption software works with all files but we have rules and for trial decrypt vm files are not allowed
[lockbit3.0] — 08.03.2023 14:37:49 UTC — Message 24/94
of course
[lockbit3.0] — 08.03.2023 14:38:04 UTC — Message 25/94
I'll come back later with proofs
[lockbit3.0] — 08.03.2023 15:11:09 UTC — Message 26/94
.vmx impossible free decrypt
[lockbit3.0] — 08.03.2023 15:12:30 UTC — Message 27/94
File: [decrypted_key.rar]
[Kaycan] — 08.03.2023 15:29:30 UTC — Message 28/94
vmx is a config file. Why is that not decryptable?
[Kaycan] — 08.03.2023 15:30:38 UTC — Message 29/94
take a partial screenshot so we know your decryptor works.
[lockbit3.0] — 08.03.2023 21:40:36 UTC — Message 30/94
File: [1.png]
[lockbit3.0] — 08.03.2023 21:40:37 UTC — Message 31/94
File: [3.png]
[lockbit3.0] — 08.03.2023 21:40:38 UTC — Message 32/94
File: [5.png]
[lockbit3.0] — 08.03.2023 21:40:42 UTC — Message 33/94
File: [4.png]
[lockbit3.0] — 08.03.2023 21:40:54 UTC — Message 34/94
File: [2.png]
[Kaycan] — 09.03.2023 15:18:05 UTC — Message 35/94
can I get a list of the files taken rathrer than a few files?
[lockbit3.0] — 09.03.2023 15:33:41 UTC — Message 36/94
File: [1.7z]
[lockbit3.0] — 09.03.2023 15:33:55 UTC — Message 37/94
File: [1.7z]
[Kaycan] — 09.03.2023 15:34:49 UTC — Message 38/94
ty will review
[lockbit3.0] — 09.03.2023 15:37:24 UTC — Message 39/94
get a move on, 3 days already gone and i don't see your offers
[Kaycan] — 09.03.2023 15:42:12 UTC — Message 40/94
is this a partial list? did you mean to send 1.7z and 2.7z?
[lockbit3.0] — 09.03.2023 15:44:59 UTC — Message 41/94
no
[lockbit3.0] — 09.03.2023 15:45:38 UTC — Message 42/94
check this list and lets talk about business
[lockbit3.0] — 11.03.2023 20:21:35 UTC — Message 43/94
Your time is almost up.
[Kaycan] — 13.03.2023 04:19:57 UTC — Message 44/94
show me these files Employee Roster HYZ 10312018.xls, Devis Entretien Ménager Uniboard-Unires Val-d'or 2023.docx, Employee Total Hours Report HY1 Salary 10312018.xls, PAYROLL9122015.xls, Mont-Laurier vs LaBaie HDF.xls, Panneaux de paille.xls,
[Kaycan] — 13.03.2023 04:20:21 UTC — Message 45/94
please bear with us time-wise. We are trying to deal with this as quickly as possible. Thank you.
[lockbit3.0] — 13.03.2023 07:35:06 UTC — Message 46/94
choose 3 of thees files
[lockbit3.0] — 13.03.2023 07:59:46 UTC — Message 47/94
File: [files (1).7z]
[lockbit3.0] — 13.03.2023 08:00:13 UTC — Message 48/94
here you go
[Kaycan] — 13.03.2023 14:54:35 UTC — Message 49/94
ty
[lockbit3.0] — 14.03.2023 09:20:41 UTC — Message 50/94
Stop stalling, I want to see numbers from you, otherwise I am preparing a press release.
[lockbit3.0] — 14.03.2023 12:46:46 UTC — Message 51/94
you have 6 hours to give me answer
[Kaycan] — 14.03.2023 16:13:52 UTC — Message 52/94
We would like to reach an agreement however we are not sure how you reached that price you are asking for? Can you offer a price that we can digest and agree?
[lockbit3.0] — 14.03.2023 18:33:31 UTC — Message 53/94
Before encrypting any network we do deeply study them. We know how much you can pay.
[Kaycan] — 14.03.2023 20:53:10 UTC — Message 54/94
How do you know how much debt we carry? None of the information you may have seen would include that. Is there any flexibility on the price?
[lockbit3.0] — 14.03.2023 20:56:45 UTC — Message 55/94
I don't really want to keep this conversation What do you want? Give me your offer
[Kaycan] — 14.03.2023 20:58:21 UTC — Message 56/94
I have no interest in insulting you with an offer because your starting amount is significant than what we have liquidity to allocate to this without debtors locking us out.
[lockbit3.0] — 14.03.2023 21:03:10 UTC — Message 57/94
I still want to see your offer. Well maybe we need to prepare a blog post for you and close this chat. I can't decide
[Kaycan] — 14.03.2023 22:27:26 UTC — Message 58/94
but why did you post us?
[Kaycan] — 14.03.2023 22:28:50 UTC — Message 59/94
can you remove our post?
[Kaycan] — 14.03.2023 22:29:22 UTC — Message 60/94
our board has agreed to offer 500k to close this incident. Do we have a deal?
[lockbit3.0] — 14.03.2023 22:30:36 UTC — Message 61/94
Because it semms you don't want to make a deal and waisting time
[lockbit3.0] — 14.03.2023 22:32:25 UTC — Message 62/94
the blog private now, i just want you know that i'm not joking with you
[lockbit3.0] — 14.03.2023 22:36:23 UTC — Message 63/94
The amount is nothing for such a company. You have a time until tomorrow to make a real offer. Otherwise I will put a blog to a public page.
[Kaycan] — 14.03.2023 22:36:23 UTC — Message 64/94
we know that.
[Kaycan] — 14.03.2023 22:36:57 UTC — Message 65/94
but you see? I told you that you do not understand our situation so why even ask for an offer?
[Kaycan] — 14.03.2023 22:37:44 UTC — Message 66/94
Look I just need to tell my management something. Are you able to provide a more reasonable price or not? the fact you already published means the company needs to take calls from the media.
[lockbit3.0] — 14.03.2023 23:36:56 UTC — Message 67/94
What was you doing last week? You just wasting my time. You see my price
[Kaycan] — 15.03.2023 04:27:26 UTC — Message 68/94
you are asking for a large amount and this requires high level of approvals. We cannot move so quickly. I know you want to get paid quickly but if I decided to ghost you we would not have been here.
[lockbit3.0] — 15.03.2023 11:59:52 UTC — Message 69/94
today i will public your blog, tomorrow i will start to upload your data for public access.
[Kaycan] — 15.03.2023 13:28:42 UTC — Message 70/94
I just want to confirm for my management, you are not interested in discussing your demands? correct?
[lockbit3.0] — 15.03.2023 15:08:02 UTC — Message 71/94
i'm not interested in 500k$
[Kaycan] — 15.03.2023 15:09:39 UTC — Message 72/94
Is there a middle ground we can reach agreement on?
[lockbit3.0] — 15.03.2023 17:17:44 UTC — Message 73/94
i dont want to answer questions, a want to see real offer. show me what you got
[lockbit3.0] — 15.03.2023 17:18:47 UTC — Message 74/94
btw discount possible just if you pay on this week
[Kaycan] — 15.03.2023 17:59:44 UTC — Message 75/94
I understand, but I am sure you know how boards work, they want to approve a specific amount not some imaginary number. If you can advise what is a realistic number for a deal I am happy to present it.
[lockbit3.0] — 15.03.2023 18:13:27 UTC — Message 76/94
8m $ is very realistic number for your company. i can give you discount 10% just if you pay this week. This is a good result of your work.
[lockbit3.0] — 16.03.2023 12:34:26 UTC — Message 77/94
any update?
[Kaycan] — 16.03.2023 16:04:40 UTC — Message 78/94
I hope to hear from management very soon
[lockbit3.0] — 16.03.2023 16:33:05 UTC — Message 79/94
hurry up
[Kaycan] — 16.03.2023 19:13:20 UTC — Message 80/94
Just completed a board discussion and the board is willing to settle this at 1.5m $ this is a big increase as you can see from our former amount but we hope you can see how serious we are to address the situation in an amicable fashion.
[lockbit3.0] — 16.03.2023 21:15:44 UTC — Message 81/94
I can't access that amount
[lockbit3.0] — 16.03.2023 22:28:05 UTC — Message 82/94
I see you're not impressed an effect of our blog post. Tomorrow the blog will be available again with. I don't care if it will not increase the offer but at least next time the recovery company will make things faster
[Kaycan] — 17.03.2023 00:07:34 UTC — Message 83/94
I am awaiting our management executive to confirm what is possible in terms of an amount for this case. You have to understand we are looking at data and cost of the incident to us. I will likely respond to you tomorrow. If you publish us again, it will have no more impact that your publication already did.
[Kaycan] — 17.03.2023 04:05:27 UTC — Message 84/94
We scheduled an afternoon board meeting as I am at my limit from a $ perspective. I will be in touch tomorrow afternoon/evening time frame.
[lockbit3.0] — 17.03.2023 17:54:51 UTC — Message 85/94
so what?
[Kaycan] — 17.03.2023 21:45:01 UTC — Message 86/94
we are just finishing the meeting where the Board approved 3.0m $ and we see you posted our company again
[lockbit3.0] — 17.03.2023 21:52:34 UTC — Message 87/94
are you ready to pay right now?
[Kaycan] — 18.03.2023 00:08:17 UTC — Message 88/94
Absolutely not. You posted us when I explained to you that we might increase our number. Remove the fucking post and I will try to save this on Monday but I am literally not promising anything. It is your choice.
[lockbit3.0] — 18.03.2023 00:23:39 UTC — Message 89/94
first of all it's your words
[lockbit3.0] — 18.03.2023 00:23:46 UTC — Message 90/94
"If you publish us again, it will have no more impact that your publication already did. "
[lockbit3.0] — 18.03.2023 00:25:08 UTC — Message 91/94
second thing ufter using "fucking" your price is 5 million and it's your last price
[lockbit3.0] — 18.03.2023 00:28:18 UTC — Message 92/94
I warned you several times, you thing that you can do what you want. probably no.
[Kaycan] — 18.03.2023 01:21:42 UTC — Message 93/94
you have the power. I told you what I said, I stand behind my statements. Your call.
[lockbit3.0] — 18.03.2023 11:24:12 UTC — Message 94/94
you know the price, work on it.