// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Myers Power Products.
The negotiation consisted of 99 messages exchanged over 22 days, beginning on 2023-01-25.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Myers Power Products] — 25.01.2023 01:27:51 UTC — Message 1/99
[Chat started]
[Myers Power Products] — 25.01.2023 01:31:21 UTC — Message 2/99
I found your note on my machines what do I do now?
[lockbit3.0] — 25.01.2023 06:05:47 UTC — Message 3/99
hi
[lockbit3.0] — 25.01.2023 06:05:47 UTC — Message 4/99
do you need decrypt?
[lockbit3.0] — 25.01.2023 06:07:18 UTC — Message 5/99
we have attacked your corporate network all your 4 TRUST domains
[lockbit3.0] — 25.01.2023 06:07:54 UTC — Message 6/99
and also all your servers are encrypted inside ESXI
[lockbit3.0] — 25.01.2023 06:09:10 UTC — Message 7/99
we also stole 250 GB of your data from all 4 of your networks, if our negotiations are unsuccessful, you will face high fines for GDRP
[lockbit3.0] — 25.01.2023 06:12:24 UTC — Message 8/99
everything is encrypted inside the virtualization of your servers, too, in order to restore all servers, this can be done with our decryptor
[Myers Power Products] — 25.01.2023 14:55:22 UTC — Message 9/99
How much is it going to cost us?
[lockbit3.0] — 25.01.2023 15:17:12 UTC — Message 10/99
price for decrypt, delete your data on our servers,conducting an audit of your cybersecurity company and how we infiltrated you will cost = 4 500 000 USD in BTC
[lockbit3.0] — 25.01.2023 15:24:04 UTC — Message 11/99
are you interested in the list of files that we stole from you?
[Myers Power Products] — 25.01.2023 15:24:53 UTC — Message 12/99
I am interested. Can you provide the list of files taken?
[lockbit3.0] — 25.01.2023 15:26:04 UTC — Message 13/99
10 min
[lockbit3.0] — 25.01.2023 15:35:07 UTC — Message 14/99
[REDACTED URL]
[lockbit3.0] — 25.01.2023 15:35:20 UTC — Message 15/99
listing here
[Myers Power Products] — 26.01.2023 14:13:30 UTC — Message 16/99
I downloaded the list. If I give you a few file names can you provide those files to show you still have them?
[lockbit3.0] — 26.01.2023 14:14:05 UTC — Message 17/99
yes give me name files
[Myers Power Products] — 26.01.2023 20:38:42 UTC — Message 18/99
Can you provide "cable specifications sheets-ctsp-sm8.pdf" and "tbs-sysmap 8 12 2010.pdf"?
[lockbit3.0] — 26.01.2023 20:41:59 UTC — Message 19/99
yes
[lockbit3.0] — 26.01.2023 20:42:01 UTC — Message 20/99
wait
[lockbit3.0] — 26.01.2023 20:51:58 UTC — Message 21/99
File: [Cable Specification Sheets - CTSP-SM8.pdf]
[lockbit3.0] — 26.01.2023 20:52:56 UTC — Message 22/99
File: [TBS-Sysmap 8 12 2010.pdf]
[Myers Power Products] — 26.01.2023 21:13:11 UTC — Message 23/99
The second file just sends me to another lockbit page and doesn't load anything?
[lockbit3.0] — 26.01.2023 21:20:14 UTC — Message 24/99
now I'm moving through the file sharing service
[lockbit3.0] — 26.01.2023 21:27:41 UTC — Message 25/99
[REDACTED URL]
[Myers Power Products] — 27.01.2023 23:01:59 UTC — Message 26/99
Can i give you files to prove you can decrypt them?
[lockbit3.0] — 27.01.2023 23:09:06 UTC — Message 27/99
Yes. You can make a test decryption by uploading the file to our portal.
[lockbit3.0] — 30.01.2023 19:03:54 UTC — Message 28/99
I am notifying you that in a month your decryptor will be deleted forever automatically. and you won't be able to restore your systems.
[Myers Power Products] — 30.01.2023 19:13:23 UTC — Message 29/99
ok sorry had issues grabbing file. I am testing the decryption link on the chat.
[lockbit3.0] — 30.01.2023 19:18:56 UTC — Message 30/99
ok
[lockbit3.0] — 30.01.2023 20:11:02 UTC — Message 31/99
you can take any small file from your PC and do the test yourself
[lockbit3.0] — 31.01.2023 17:56:55 UTC — Message 32/99
so that you do not delay the negotiations and there is no action from you, then within 48 hours we will publish your company on our leaks website
[Myers Power Products] — 31.01.2023 20:06:45 UTC — Message 33/99
I have the file and testing today. I did find something odd though and wanted to get confirmation from you.
[Myers Power Products] — 31.01.2023 20:07:26 UTC — Message 34/99
We found another note on one of our servers claiming to be lockbit2 and has a completely different link. Do I have to go to that link to?
[lockbit3.0] — 31.01.2023 20:08:16 UTC — Message 35/99
we have encrypted you with several types of our software
[lockbit3.0] — 31.01.2023 20:08:59 UTC — Message 36/99
lockbit 2.0 (red), lockbit black, lockbit esxi version
[Myers Power Products] — 31.01.2023 20:09:36 UTC — Message 37/99
Is the same decryptor used or will we get multiple decryptors?
[lockbit3.0] — 31.01.2023 20:10:48 UTC — Message 38/99
get your own decriptors for each version, they are convenient for us and you will not have any problems
[lockbit3.0] — 31.01.2023 20:11:45 UTC — Message 39/99
you can test from the version you found to make a test
[Myers Power Products] — 31.01.2023 20:13:24 UTC — Message 40/99
Ok, i grabbed a file that is too big anyways I need to grab a smaller file. I will grab a file from the lockbit 2.0 one.
[lockbit3.0] — 31.01.2023 20:14:51 UTC — Message 41/99
yes good
[lockbit3.0] — 01.02.2023 14:17:36 UTC — Message 42/99
any updates?
[Myers Power Products] — 01.02.2023 14:35:31 UTC — Message 43/99
I got the file and testing decryption soon.
[Myers Power Products] — 01.02.2023 14:36:34 UTC — Message 44/99
I received a message the file cannot be decrypted?
[lockbit3.0] — 01.02.2023 14:38:03 UTC — Message 45/99
send me the file here
[Myers Power Products] — 01.02.2023 14:38:12 UTC — Message 46/99
File: [insink.txt.lockbit]
[lockbit3.0] — 01.02.2023 14:51:07 UTC — Message 47/99
File: [insink.txt]
[lockbit3.0] — 01.02.2023 15:00:49 UTC — Message 48/99
test is working! when will you make the payment?
[lockbit3.0] — 02.02.2023 15:39:59 UTC — Message 49/99
any updates?
[Myers Power Products] — 02.02.2023 17:11:11 UTC — Message 50/99
$4.5 million is a lot of money.
[lockbit3.0] — 02.02.2023 17:15:18 UTC — Message 51/99
the price is from your income of your all companies! you're not a small company
[lockbit3.0] — 03.02.2023 14:52:02 UTC — Message 52/99
why are you delaying the negotiations? are you waiting for publicity about your companies? or until the time of the decrypt runs out and he retires?
[Myers Power Products] — 03.02.2023 14:55:39 UTC — Message 53/99
We are not delaying. I am willing to negotiate the price but $4.5 million is too much.
[lockbit3.0] — 03.02.2023 14:56:51 UTC — Message 54/99
I am waiting for a serious offer from you closer to our price (I am ready to discuss a discount)
[Myers Power Products] — 03.02.2023 14:57:24 UTC — Message 55/99
What discount are you will to give?
[lockbit3.0] — 03.02.2023 14:58:09 UTC — Message 56/99
30%
[lockbit3.0] — 03.02.2023 14:58:43 UTC — Message 57/99
payment for 72 hours discount will be valid
[lockbit3.0] — 03.02.2023 15:23:43 UTC — Message 58/99
will you have enough time?
[lockbit3.0] — 03.02.2023 21:19:42 UTC — Message 59/99
have you discussed our offer with the boss?
[lockbit3.0] — 06.02.2023 12:40:27 UTC — Message 60/99
any updates?
[lockbit3.0] — 06.02.2023 13:05:26 UTC — Message 61/99
your time is running out soon (discount), as well as you will lose the chance to return everything and get big fines for GTRD
[Myers Power Products] — 06.02.2023 18:43:56 UTC — Message 62/99
Sorry was trying to access the page and it wouldn't load. So i tried the other links and it gave me a blank chat.
[Myers Power Products] — 06.02.2023 18:44:43 UTC — Message 63/99
I sent everything across, my boss needs more time he had to get a board meeting together. Even with the discount $3mil is a lot of money we can't get that together quickly
[lockbit3.0] — 06.02.2023 19:55:47 UTC — Message 64/99
you can write to any chat to us
[lockbit3.0] — 06.02.2023 19:56:33 UTC — Message 65/99
How much time do you need?
[Myers Power Products] — 06.02.2023 20:20:25 UTC — Message 66/99
Ok, I didn't know that. Thanks.
[Myers Power Products] — 06.02.2023 20:21:11 UTC — Message 67/99
We have the board meeting tomorrow afternoon. Could you give us another 48 hours. I would have a better understanding of the amount we can have together.
[lockbit3.0] — 06.02.2023 21:31:59 UTC — Message 68/99
yes, we are making concessions to you on time!
[Myers Power Products] — 06.02.2023 22:14:48 UTC — Message 69/99
Thank you! I will keep you updated.
[lockbit3.0] — 07.02.2023 19:52:35 UTC — Message 70/99
we wait you
[lockbit3.0] — 08.02.2023 15:34:09 UTC — Message 71/99
how did the board of directors' negotiations go? the time you asked for will soon be over
[Myers Power Products] — 08.02.2023 21:54:21 UTC — Message 72/99
We are still here. The board is behind us it is more about collection of funds.
[lockbit3.0] — 08.02.2023 22:31:45 UTC — Message 73/99
how much time do you need?
[Myers Power Products] — 09.02.2023 14:07:25 UTC — Message 74/99
I am not sure. Just a slow process. Our insurance only covered so much. We have to make up the difference. I will get a better time frame for you. Trying to figure it out ourselves
[lockbit3.0] — 09.02.2023 14:10:37 UTC — Message 75/99
will we be able to fix the amount in bitcoins with you now? due to the high volatility of cryptocurrencies, it is better to fix immediately (for 48 hours)
[Myers Power Products] — 09.02.2023 14:11:59 UTC — Message 76/99
Sorry, I don't understand
[lockbit3.0] — 09.02.2023 14:13:15 UTC — Message 77/99
you will transfer the amount in bitcoins, the amount equivalent to the one we agreed with you, the price of cryptocurrencies often changes and we need to fix the amount that you have to transfer to us
[lockbit3.0] — 09.02.2023 14:18:32 UTC — Message 78/99
138.5 BTC you need a transaction to us WALLETS
[lockbit3.0] — 09.02.2023 14:19:07 UTC — Message 79/99
do we fix this amount for 48 hours?
[Myers Power Products] — 09.02.2023 14:25:03 UTC — Message 80/99
I understand. So instead of usd comparison we would do 138.5 btc. We are working to get that amount of cash to purchase the btc. insurance only covered a small percentage so we have to come up with the rest.
[lockbit3.0] — 09.02.2023 14:31:23 UTC — Message 81/99
hurry up, we made concessions to you and gave you a discount from our first price
[lockbit3.0] — 10.02.2023 15:58:24 UTC — Message 82/99
do you have time in our time (48 hours)?
[lockbit3.0] — 10.02.2023 20:51:31 UTC — Message 83/99
you here?
[Myers Power Products] — 10.02.2023 20:52:08 UTC — Message 84/99
I am still hear just trying to work on getting it together. It's a lot of money to pull together and it is taking time.
[lockbit3.0] — 10.02.2023 21:11:50 UTC — Message 85/99
how much time do you need? we will issue a post about you in the near future! don't try to leave for the weekend!
[Myers Power Products] — 11.02.2023 21:07:59 UTC — Message 86/99
didn't leave its not easy to get 3 mil when insurance doesn't help. We are working on the loans but it will be at least Monday.
[lockbit3.0] — 11.02.2023 21:14:50 UTC — Message 87/99
ok we wait you
[lockbit3.0] — 13.02.2023 16:32:12 UTC — Message 88/99
any updates?
[lockbit3.0] — 13.02.2023 21:29:38 UTC — Message 89/99
what news do you have?
[lockbit3.0] — 14.02.2023 17:55:50 UTC — Message 90/99
ok, since you don't tell us anything, it was decided to create a blog with your companies in our blog in 3-4 hours. we will publish documents and correspondence with you (with a payment timer)
[lockbit3.0] — 14.02.2023 19:44:38 UTC — Message 91/99
File: [lyonhealy.com-full-listing.rar]
[lockbit3.0] — 14.02.2023 20:45:27 UTC — Message 92/99
I'm sorry I messed up the chat, it's not for you!
[lockbit3.0] — 14.02.2023 20:46:09 UTC — Message 93/99
we have issued a block, with a timer and proof that we were in your network! 48 hours to get in touch
[lockbit3.0] — 15.02.2023 12:11:12 UTC — Message 94/99
[REDACTED URL]
[lockbit3.0] — 15.02.2023 14:36:40 UTC — Message 95/99
the private link is valid for 48 hours, then you will be in our blog, will we delay the payment?
[lockbit3.0] — 16.02.2023 18:42:21 UTC — Message 96/99
why are you here?
[lockbit3.0] — 16.02.2023 18:47:08 UTC — Message 97/99
will you be silent as well? are we publishing all your data?
[lockbit3.0] — 16.02.2023 18:47:24 UTC — Message 98/99
we will also publish this correspondence with you
[lockbit3.0] — 16.02.2023 20:01:02 UTC — Message 99/99
attached our chat! it will be at the expiration of the timer!