// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Millennia Professional.
The negotiation consisted of 43 messages exchanged over 23 days, beginning on 2023-01-02.
The initial ransom demand was $2,023. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Millennia Professional] — 02.01.2023 19:09:19 UTC — Message 1/43
[Chat started]
[Millennia Professional] — 02.01.2023 19:10:34 UTC — Message 2/43
Hello dear sirs, How much to unencrypt files on my network?
[Millennia Professional] — 02.01.2023 21:47:37 UTC — Message 3/43
bump
[lockbit3.0] — 03.01.2023 00:04:44 UTC — Message 4/43
300 000$ fo all
[lockbit3.0] — 03.01.2023 00:05:24 UTC — Message 5/43
300 000$ for all pc
[lockbit3.0] — 03.01.2023 00:20:38 UTC — Message 6/43
Also, if you have any thoughts of refusing to pay 2023-02-21 07:16:07, we will publish the data that was stolen from your online storage. If you choose to use the backups you have, we will simply publish your company's financial documents. At the moment your documents are being processed in our TOR cloud storage, in about 2 weeks they will be available. For now, we can only report the volume of stolen data - 30 GB.
[Millennia Professional] — 03.01.2023 00:26:35 UTC — Message 7/43
Thank you for the update. I will let management know.
[lockbit3.0] — 03.01.2023 00:27:37 UTC — Message 8/43
ok
[Millennia Professional] — 03.01.2023 20:04:42 UTC — Message 9/43
Trying to understand what 300,000 is for. This will unencrypt the files on network? I am being told that some are encrypted with lockbit 2.0 and others with 3.0. Is this able to be done at once?
[lockbit3.0] — 03.01.2023 20:06:33 UTC — Message 10/43
300,000 for all computers. We will give you both versions of the decryptor for both the 2.0 and 3.0 Black versions
[Millennia Professional] — 03.01.2023 20:10:21 UTC — Message 11/43
And the published data?
[lockbit3.0] — 03.01.2023 20:11:00 UTC — Message 12/43
The data will not be published and will be deleted automatically upon payment
[Millennia Professional] — 03.01.2023 20:13:44 UTC — Message 13/43
Thank you. I will relay the information.
[lockbit3.0] — 03.01.2023 20:15:09 UTC — Message 14/43
ok
[lockbit3.0] — 05.01.2023 05:26:10 UTC — Message 15/43
File: [files_tree_b4e3588c39.txt]
[lockbit3.0] — 05.01.2023 05:27:13 UTC — Message 16/43
This is a list of your data that was stolen.
[Millennia Professional] — 05.01.2023 12:22:15 UTC — Message 17/43
Is this a complete list?
[lockbit3.0] — 05.01.2023 12:22:46 UTC — Message 18/43
Yes
[Millennia Professional] — 05.01.2023 12:23:24 UTC — Message 19/43
Thank you, I will relay.
[lockbit3.0] — 05.01.2023 12:23:34 UTC — Message 20/43
ok
[lockbit3.0] — 07.01.2023 19:22:38 UTC — Message 21/43
any info?
[lockbit3.0] — 09.01.2023 16:43:52 UTC — Message 22/43
[REDACTED URL]
[Millennia Professional] — 09.01.2023 16:45:18 UTC — Message 23/43
We are recieving phone call because we are no communicating in chat. I this your team or am I communicating on the wrong channel? I have been tasked in finding out what country your group originates from and if there is any movement on the number you have given?
[lockbit3.0] — 09.01.2023 16:46:19 UTC — Message 24/43
Yes the call was indeed made by us
[lockbit3.0] — 09.01.2023 16:50:11 UTC — Message 25/43
We attack companies all over the world and speak virtually every language.
[Millennia Professional] — 09.01.2023 16:52:38 UTC — Message 26/43
I'm sure you do, but to which country is the money going when you get paid?
[Millennia Professional] — 09.01.2023 16:54:01 UTC — Message 27/43
Also, is there a movement on the 300,000
[lockbit3.0] — 09.01.2023 16:55:29 UTC — Message 28/43
The payment is made in BTC cryptocurrency and you will never know about it. However, we can say that we are not political hackers, you just have weak security and we need money, that's all.
[lockbit3.0] — 09.01.2023 16:57:36 UTC — Message 29/43
bc1qx9upga7f09tsetqf78wa3qrmcjar58mkwz6ng6 - BTC wallet
[Millennia Professional] — 09.01.2023 16:58:59 UTC — Message 30/43
300,000 is a lot of $$. Can that be reduced?
[Millennia Professional] — 09.01.2023 16:59:15 UTC — Message 31/43
On your feed, it says $500,000
[lockbit3.0] — 09.01.2023 17:00:50 UTC — Message 32/43
If the documents that we have get into the public domain, believe me, this amount will seem insignificant because of the losses that can result from leak
[Millennia Professional] — 09.01.2023 17:02:23 UTC — Message 33/43
I will take that information back to them.
[lockbit3.0] — 09.01.2023 17:03:05 UTC — Message 34/43
This is the price for your competitors, if someone wants to buy your company's internal documentation, we will sell it to them, but the sooner you pay the amount offered to you, the less likely it is that someone will use the information
[lockbit3.0] — 09.01.2023 17:05:09 UTC — Message 35/43
If you want to keep your data from falling into the wrong hands or other organizations, you need to resolve the $300,000 ransom payment as soon as possible, and the data will be destroyed
[lockbit3.0] — 09.01.2023 17:06:12 UTC — Message 36/43
And accordingly you get a decryptor for both versions of Lockbit 2.0 and 3.0 black
[Millennia Professional] — 09.01.2023 17:07:21 UTC — Message 37/43
Appreciate the clarification
[lockbit3.0] — 10.01.2023 18:07:05 UTC — Message 38/43
Do you have any new information? Have you started preparing to pay yet?
[Millennia Professional] — 11.01.2023 14:37:45 UTC — Message 39/43
I do not at this time.
[lockbit3.0] — 11.01.2023 14:38:54 UTC — Message 40/43
You have 17 days left, we advise you to prepare everything in advance
[Millennia Professional] — 11.01.2023 15:22:53 UTC — Message 41/43
Noted.
[lockbit3.0] — 13.01.2023 19:56:20 UTC — Message 42/43
Hi, do you have any new information?
[lockbit3.0] — 25.01.2023 17:44:24 UTC — Message 43/43
We are willing to drop the price for you. The final price is $200,000 this is our final offer!