// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with La Poste Mobile.
The negotiation consisted of 93 messages exchanged over 5 days, beginning on 2022-07-06.
The initial ransom demand was $600,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[La Poste Mobile] — 06.07.2022 14:40:03 UTC — Message 1/93
[Chat started]
[lockbit3.0] — 06.07.2022 15:06:59 UTC — Message 2/93
Hello.
[lockbit3.0] — 06.07.2022 15:19:04 UTC — Message 3/93
I think you understand what situation you are in, you have 2 options for the development of events, the first is that you start cooperating with us, pay the amount we need, get the decryptor program, we delete the files stolen from you. Either you keep silent and refuse us and we will start publishing the personal data of your customers, you have a fairly extensive database.
[lockbit3.0] — 06.07.2022 16:28:51 UTC — Message 4/93
little sample from your database export, [REDACTED URL]
[La Poste Mobile] — 08.07.2022 13:04:19 UTC — Message 5/93
Hi,
[La Poste Mobile] — 08.07.2022 13:05:22 UTC — Message 6/93
i have 2 questions How much data in GB or TB have you exfiltrate? And how much would you like?
[lockbit3.0] — 08.07.2022 15:37:18 UTC — Message 7/93
did you get our example? let's say we have more than 1 TB, we will issue all the rest of the information after payment.
[lockbit3.0] — 08.07.2022 15:39:04 UTC — Message 8/93
the decryption price for you is 1.400.000$ after payment, we will immediately issue you a decryptor, a list of databases stolen from you, and also their removal.
[La Poste Mobile] — 08.07.2022 15:42:40 UTC — Message 9/93
yes, could you send me a new sample please ?
[lockbit3.0] — 08.07.2022 15:44:56 UTC — Message 10/93
One sample is enough. Think about payment, you have little time, our patience is running out.
[La Poste Mobile] — 08.07.2022 15:54:47 UTC — Message 11/93
in fact the files that i've downloaded is an old files, if you don't have a fresher sample, I wouldn't buy it at this price..
[lockbit3.0] — 08.07.2022 16:00:39 UTC — Message 12/93
We will gradually publish the files downloaded from you, first unloading from the databases, then the databases themselves, then the files. You have a price, think. This price also includes the decryptor program.
[lockbit3.0] — 08.07.2022 16:02:07 UTC — Message 13/93
Regarding the relevance of the data, it is strange that fresh dates are registered there, specifically in the first database that is ready for publication.
[La Poste Mobile] — 08.07.2022 16:06:12 UTC — Message 14/93
don't want to negociate ?
[lockbit3.0] — 08.07.2022 16:06:49 UTC — Message 15/93
Wait for your offers.
[La Poste Mobile] — 08.07.2022 16:08:44 UTC — Message 16/93
ok if you send me a new fresh sample ..
[lockbit3.0] — 08.07.2022 16:12:36 UTC — Message 17/93
You were given one example, that's enough, our task is to show you that we have something, and then think for yourself. I'm listening to your payment suggestions.
[La Poste Mobile] — 08.07.2022 16:18:51 UTC — Message 18/93
ok then I will wait for your first publications ..
[lockbit3.0] — 08.07.2022 16:20:47 UTC — Message 19/93
Good.
[La Poste Mobile] — 08.07.2022 16:32:03 UTC — Message 20/93
For the other targets, you've published different files and for us just this database extract. so i have a doubt if you have other files, i am ready to negotiate but if you have only this database, it will not be at this price..
[lockbit3.0] — 08.07.2022 16:37:04 UTC — Message 21/93
We are open to negotiations about the price, we have given everything you need. Files will not be opened until publication.
[lockbit3.0] — 08.07.2022 16:38:04 UTC — Message 22/93
Think about your reputation, you have money, pay and keep customer data safe.
[La Poste Mobile] — 08.07.2022 16:42:51 UTC — Message 23/93
see you later .. i'm sorry i'm sick i have the covid
[lockbit3.0] — 08.07.2022 16:49:44 UTC — Message 24/93
Good luck. Get well.
[lockbit3.0] — 08.07.2022 16:51:10 UTC — Message 25/93
You still have 3 days to think about your clients and make us an offer based on the data we gave you.
[lockbit3.0] — 08.07.2022 18:39:16 UTC — Message 26/93
File: [4.png]
[lockbit3.0] — 08.07.2022 18:39:56 UTC — Message 27/93
One of the bases that is ready for publication on Monday.
[La Poste Mobile] — 09.07.2022 08:24:21 UTC — Message 28/93
We offer you $100,000 for everything, knowing that it's the weekend and everything is complicated
[La Poste Mobile] — 09.07.2022 08:26:40 UTC — Message 29/93
in addition it is the holidays in France
[lockbit3.0] — 09.07.2022 09:40:35 UTC — Message 30/93
I will go to your meeting and make an offer of one day, 600.000 for everything, and the issue with us is closed. Believe me, we don't usually make such offers.
[La Poste Mobile] — 09.07.2022 09:58:27 UTC — Message 31/93
I can't go to a meeting I have covid, but I already know their answer..
[lockbit3.0] — 09.07.2022 10:02:47 UTC — Message 32/93
The initial amount that was billed to your company is 1.400.000, we are ready to meet you and reduce the amount to 600.000 thousand dollars, but this is a one-day offer, after payment you will receive a complete list of the files that we stole from you, we undertake to delete them, and you will also receive a decryptor program that will decrypt all computers that have been attacked on your network.
[La Poste Mobile] — 09.07.2022 10:06:28 UTC — Message 33/93
if I don't have the list of files I couldn't negotiate with the management..
[La Poste Mobile] — 09.07.2022 10:07:15 UTC — Message 34/93
I know that you have the cards in hand, but my hands are tied without the list
[lockbit3.0] — 09.07.2022 10:12:23 UTC — Message 35/93
I've already sent you more than I'm allowed to, and I'm going to meet you. You should work with what you have, if you want to negotiate with us, we are waiting for a new offer from you of a more realistic amount.
[La Poste Mobile] — 09.07.2022 10:15:27 UTC — Message 36/93
I have nothing more to offer you at the moment and the screenshot of the database does not speak to us..
[lockbit3.0] — 09.07.2022 10:17:20 UTC — Message 37/93
Now I will send you a couple more tables from this database.
[La Poste Mobile] — 09.07.2022 10:19:57 UTC — Message 38/93
ok if I have marbles I can negotiate without marbles I cannot .. it"s a french expression
[lockbit3.0] — 09.07.2022 10:21:33 UTC — Message 39/93
I will definitely remember this expression. By the way, do not forget about another marbles called the decoder program
[La Poste Mobile] — 09.07.2022 10:26:31 UTC — Message 40/93
The system is gradually getting back in place.
[lockbit3.0] — 09.07.2022 10:28:10 UTC — Message 41/93
[REDACTED URL]
[lockbit3.0] — 09.07.2022 10:28:28 UTC — Message 42/93
[REDACTED URL]
[lockbit3.0] — 09.07.2022 10:28:37 UTC — Message 43/93
When you download the files, tell me I will delete them.
[La Poste Mobile] — 09.07.2022 10:51:24 UTC — Message 44/93
ok for me you can delete them
[lockbit3.0] — 09.07.2022 11:15:48 UTC — Message 45/93
done.
[La Poste Mobile] — 09.07.2022 11:21:04 UTC — Message 46/93
you don't have more crunchy ?
[lockbit3.0] — 09.07.2022 11:26:20 UTC — Message 47/93
That's enough, we are waiting for your offer. Everything else after payment.
[La Poste Mobile] — 09.07.2022 11:30:56 UTC — Message 48/93
not for us ..
[lockbit3.0] — 09.07.2022 11:31:38 UTC — Message 49/93
Then wait for publications, 100.000 does not suit us.
[La Poste Mobile] — 09.07.2022 11:33:38 UTC — Message 50/93
sorry , it is not who decides ..
[lockbit3.0] — 09.07.2022 11:34:23 UTC — Message 51/93
maybe it will be clearer
[La Poste Mobile] — 09.07.2022 11:41:06 UTC — Message 52/93
wait and see ... is it sunny in russia?
[lockbit3.0] — 09.07.2022 11:42:01 UTC — Message 53/93
I don’t know, I think you need to ask Ivan with whom your administrator communicates.
[lockbit3.0] — 09.07.2022 11:45:09 UTC — Message 54/93
Today is a short day, we are waiting for an offer for payment, then we can talk about the weather.
[La Poste Mobile] — 09.07.2022 11:53:42 UTC — Message 55/93
Which of our administrators? sincerely i don't understand ..
[lockbit3.0] — 09.07.2022 11:55:26 UTC — Message 56/93
When we got on [redacted]'s computer, he was in correspondence with Ivan.
[lockbit3.0] — 09.07.2022 12:02:21 UTC — Message 57/93
After payment, you will receive not only a decryptor and deletion of files, but I will also give you a couple of tips for free on how not to get into such situations. I'm waiting for payment offers.
[La Poste Mobile] — 09.07.2022 12:07:50 UTC — Message 58/93
The flaw is the human so unfortunately there will always be flaws..
[La Poste Mobile] — 09.07.2022 12:09:12 UTC — Message 59/93
i'm like you, i wait ...
[lockbit3.0] — 09.07.2022 12:10:57 UTC — Message 60/93
Waiting for what?
[La Poste Mobile] — 09.07.2022 12:11:46 UTC — Message 61/93
decision of my direction ...
[La Poste Mobile] — 09.07.2022 12:13:31 UTC — Message 62/93
Is it a good business ransomware?
[lockbit3.0] — 09.07.2022 12:16:02 UTC — Message 63/93
The returns are certainly good, but you have to evaluate the consequences and live with it. This business does not forgive mistakes.
[La Poste Mobile] — 09.07.2022 12:18:16 UTC — Message 64/93
I understand, each his cross ;-)
[lockbit3.0] — 09.07.2022 12:22:59 UTC — Message 65/93
Correctly. How are you feeling ? Is oxygen saturation in the blood normal?
[La Poste Mobile] — 09.07.2022 12:40:43 UTC — Message 66/93
It's good for the moment, I have a fever and I cough
[La Poste Mobile] — 10.07.2022 11:58:35 UTC — Message 67/93
to prepare the ground, could you send me your bitcoin wallet ?
[lockbit3.0] — 10.07.2022 12:01:27 UTC — Message 68/93
as soon as you are ready for payment, tell me, I will issue the address. Wallets are valid for a limited time.
[La Poste Mobile] — 10.07.2022 12:06:00 UTC — Message 69/93
ola, if it's too limited it will never work, the processes are long here ... i prefer prepare the ground
[lockbit3.0] — 10.07.2022 12:07:20 UTC — Message 70/93
I need to know the specific time, then I can prepare the wallet.
[lockbit3.0] — 10.07.2022 12:08:31 UTC — Message 71/93
In addition, if we agree on the terms, then I will delete the post from the blog.
[La Poste Mobile] — 10.07.2022 12:08:45 UTC — Message 72/93
i don't know ... it's not my responsibility
[lockbit3.0] — 10.07.2022 12:11:42 UTC — Message 73/93
I understand, but we need to come to something, let's say you say that you will pay within 2 days, during which time I will delete the post from the blog and give you the address.
[La Poste Mobile] — 10.07.2022 15:08:30 UTC — Message 74/93
you will have to leave the wallet for at least a day, otherwise it is not even worth imagining the payment, the decision-making circuits are very very long with us.
[lockbit3.0] — 10.07.2022 15:09:20 UTC — Message 75/93
bc1qp5erh27wesmm8sxljg9p39nua02gd02e4cwk2e
[La Poste Mobile] — 10.07.2022 15:10:06 UTC — Message 76/93
i transfert .. thanks
[lockbit3.0] — 10.07.2022 15:13:50 UTC — Message 77/93
I have deleted the blog post and if things get resolved soon I will delete your files from our servers and issue you with a decryptor. If you make the wrong decision, you know the consequences. I'm waiting for you with news.
[La Poste Mobile] — 10.07.2022 16:55:42 UTC — Message 78/93
Sorry management won't go over $100,000 , i just received the information .. up to you.
[lockbit3.0] — 10.07.2022 16:57:41 UTC — Message 79/93
No, it's up to you, we are not satisfied with this amount.
[lockbit3.0] — 10.07.2022 16:59:27 UTC — Message 80/93
300.000$, our last offer to you.
[lockbit3.0] — 11.07.2022 01:39:13 UTC — Message 81/93
In case of refusal, we will gradually publish your files, starting with OTD_CLIENT and OTD_BOX (full export) - [REDACTED URL] Next, we will begin to gradually lay out your entire databases. It will definitely hurt your reputation. For the last time, are you sure about your decision?
[lockbit3.0] — 11.07.2022 01:39:33 UTC — Message 82/93
You can see what I have prepared for publication at this link. [REDACTED URL]
[La Poste Mobile] — 11.07.2022 07:25:52 UTC — Message 83/93
150000$ no more ..
[lockbit3.0] — 11.07.2022 08:36:26 UTC — Message 84/93
I'm starting to post files, all the best.
[La Poste Mobile] — 11.07.2022 08:54:35 UTC — Message 85/93
ok you have the card in your hand, not me .. i'm not decide ..
[lockbit3.0] — 11.07.2022 13:39:28 UTC — Message 86/93
[REDACTED URL]
[lockbit3.0] — 11.07.2022 13:41:58 UTC — Message 87/93
The last price is 300.000$ you have 4 hours to make a decision.
[La Poste Mobile] — 11.07.2022 13:58:24 UTC — Message 88/93
Management doesn’t want to pay anymore, not even $100,000, it has reconsidered its decision ...
[La Poste Mobile] — 11.07.2022 13:58:54 UTC — Message 89/93
i finished my work .. bye
[lockbit3.0] — 11.07.2022 14:00:39 UTC — Message 90/93
Bye
[lockbit3.0] — 11.07.2022 15:01:38 UTC — Message 91/93
[REDACTED URL]
[La Poste Mobile] — 11.07.2022 15:15:13 UTC — Message 92/93
thanks
[lockbit3.0] — 11.07.2022 15:21:28 UTC — Message 93/93
Just in case management changes their mind and takes care of the customers.