// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Newbridge.
The negotiation consisted of 70 messages exchanged over 31 days, beginning on 2023-01-27.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Newbridge] — 27.01.2023 22:48:43 UTC — Message 1/70
[Chat started]
[lockbit3.0] — 27.01.2023 22:49:52 UTC — Message 2/70
hi. to decrypt the data and avoid publication you need to pay us. we haven't published your name on our blog yet
[lockbit3.0] — 27.01.2023 22:51:46 UTC — Message 3/70
soon we will send you a tree of stolen data
[Newbridge] — 27.01.2023 22:52:33 UTC — Message 4/70
We found your telling us to come here. What is going on?
[lockbit3.0] — 27.01.2023 22:53:31 UTC — Message 5/70
need to pay
[lockbit3.0] — 27.01.2023 22:54:42 UTC — Message 6/70
[REDACTED URL]
[Newbridge] — 28.01.2023 14:10:03 UTC — Message 7/70
Thank you for the list. You said we need to pay, how much is that?
[lockbit3.0] — 28.01.2023 17:13:02 UTC — Message 8/70
250000$
[lockbit3.0] — 28.01.2023 17:13:29 UTC — Message 9/70
after payment, we will delete your data and provide a decryptor
[Newbridge] — 29.01.2023 15:32:02 UTC — Message 10/70
The list is with leadership for review. Is this the full list of all data taken?
[lockbit3.0] — 29.01.2023 15:35:40 UTC — Message 11/70
yes
[lockbit3.0] — 30.01.2023 12:51:00 UTC — Message 12/70
time to pay now
[Newbridge] — 30.01.2023 14:12:26 UTC — Message 13/70
Thank you for answering our questions. The leadership is reviewing the file list. No one was here over the weekend to get this done. Thank you for your patience.
[lockbit3.0] — 30.01.2023 14:14:21 UTC — Message 14/70
OK
[Newbridge] — 31.01.2023 15:09:59 UTC — Message 15/70
the list is rather large! How much data in all did you take? It seems like alot!
[lockbit3.0] — 31.01.2023 17:16:04 UTC — Message 16/70
all the data we took is on this list. when you pay, we will permanently delete it, and decrypt all your systems. the sooner you pay, the sooner it will be over and you will go back to your old life
[Newbridge] — 01.02.2023 14:29:52 UTC — Message 17/70
How do we know you have this data?
[lockbit3.0] — 01.02.2023 14:31:07 UTC — Message 18/70
select some files from the tree, and we will send them
[Newbridge] — 02.02.2023 13:49:01 UTC — Message 19/70
OK. I will get with my leadership so they can choose what files to send.
[lockbit3.0] — 02.02.2023 14:20:41 UTC — Message 20/70
hurry
[Newbridge] — 03.02.2023 14:03:48 UTC — Message 21/70
It's a long list. How much data is this?! We are hopeful to have the file names for you today or tomorrow morning.
[lockbit3.0] — 03.02.2023 14:06:39 UTC — Message 22/70
ok
[Newbridge] — 04.02.2023 13:34:47 UTC — Message 23/70
Here is the list of files. NEWBRIDGE\2021 DMHAS license\licenses expansion\attachmentsCO - Parsippany.pdf \ NEWBRIDGE\HR\HR FORMS\Job Posting & Change FormsCHANGE OF STATUS Checklist 1.14.2020.docx \ NEWBRIDGE\HR\Job Announcements\2022Clinician Sparta-FT internal- 9.2.22.docx \ NEWBRIDGE\HR\HR FORMS\AccommodationsAccommodation REQUEST - Employee.docx \ NEWBRIDGE\2021 DMHAS license\continuation letter 1.26.21New Bridge Services Inc. 1-26-21 Continuation Letter (003).docx
[lockbit3.0] — 04.02.2023 15:01:28 UTC — Message 24/70
ok, wait
[lockbit3.0] — 04.02.2023 15:32:14 UTC — Message 25/70
[REDACTED URL]
[lockbit3.0] — 04.02.2023 15:32:31 UTC — Message 26/70
password qtuhK4vpjG^fgM5ZRm$psn5mO
[Newbridge] — 05.02.2023 14:13:15 UTC — Message 27/70
Thank you for the files. I will give them to my leadership to review.
[lockbit3.0] — 05.02.2023 14:20:11 UTC — Message 28/70
OK
[Newbridge] — 07.02.2023 17:26:34 UTC — Message 29/70
what is the next step in this process?
[lockbit3.0] — 07.02.2023 17:27:04 UTC — Message 30/70
You pay
[Newbridge] — 08.02.2023 14:17:21 UTC — Message 31/70
How do we know you can fix our systems?
[lockbit3.0] — 08.02.2023 14:30:14 UTC — Message 32/70
You have the opportunity to make test decryptions
[lockbit3.0] — 08.02.2023 14:31:15 UTC — Message 33/70
After payment, we will provide you with a decryptor for the entire network, identify vulnerabilities and delete your data
[Newbridge] — 09.02.2023 14:23:11 UTC — Message 34/70
How do we make test decryptions?
[lockbit3.0] — 09.02.2023 14:27:49 UTC — Message 35/70
There is a mention on your page, upload a small encrypted file
[lockbit3.0] — 09.02.2023 14:30:22 UTC — Message 36/70
Please perform the actions faster.Otherwise, we will change the negotiator, and make mentions of your company on the blog.
[lockbit3.0] — 09.02.2023 15:54:14 UTC — Message 37/70
I know that your goal is to drag out negotiations as long as possible so that we get nervous and agree to a smaller amount. by asking dumb questions you are playing against yourself and risk getting blogged. the test decryptor window is to the left of the chat.
[Newbridge] — 09.02.2023 20:34:17 UTC — Message 38/70
We are not trying to drag anything out. We have never dealt with anything like this before and I wanted to be sure. I will get my leadership team to give me some files.
[lockbit3.0] — 09.02.2023 20:43:48 UTC — Message 39/70
you can say what you want, but we have a lot of experience and we understand everything. each machine has its own ID. for a successful transcription you need to take the file from your PC, with the ID you are logged into the chat! or go to the chat with the ID of the PC from which you take the file for test decryption
[Newbridge] — 10.02.2023 17:10:11 UTC — Message 40/70
The decrypted file that you sent us looks corrupt. Can we send you another one.
[lockbit3.0] — 10.02.2023 17:53:46 UTC — Message 41/70
You can follow the link to the chat from any PC, take the file from this PC and use the test decryption
[Newbridge] — 10.02.2023 19:44:28 UTC — Message 42/70
We tried to do it on another PC. Your decrypt tester is not letting us upload any more files.
[lockbit3.0] — 10.02.2023 19:47:38 UTC — Message 43/70
send the file, we will decrypt it for you. it should not be an important file, a picture or pdf
[Newbridge] — 10.02.2023 19:52:30 UTC — Message 44/70
[REDACTED URL]
[Newbridge] — 10.02.2023 19:53:06 UTC — Message 45/70
We've tried to attach more files in the chat but it wont work. Does this work for you?
[lockbit3.0] — 10.02.2023 19:58:37 UTC — Message 46/70
ok, wait
[lockbit3.0] — 11.02.2023 06:09:27 UTC — Message 47/70
File: [inetres.adm.7z]
[Newbridge] — 13.02.2023 14:49:12 UTC — Message 48/70
Thank you for the file. I gave it to my leadership to review.
[lockbit3.0] — 13.02.2023 14:50:08 UTC — Message 49/70
hurry up! very slow
[Newbridge] — 14.02.2023 15:26:58 UTC — Message 50/70
My leadership said that they don't know what that file was that you sent and they wanted to send another one.
[lockbit3.0] — 14.02.2023 15:32:25 UTC — Message 51/70
You sent us the file yourself. Okay. Send us another file
[lockbit3.0] — 14.02.2023 19:23:08 UTC — Message 52/70
You will do the test yourself faster if you perform the action correctly.Your visiting this chat room once a day does not contribute to the solution.
[Newbridge] — 14.02.2023 20:22:30 UTC — Message 53/70
Ok. We will find one and get back to you ASAP.
[lockbit3.0] — 14.02.2023 20:24:09 UTC — Message 54/70
hurry up
[Newbridge] — 15.02.2023 19:45:34 UTC — Message 55/70
Since all the names were changed on our files it is taking a long time making the appropriate selection.
[lockbit3.0] — 15.02.2023 19:52:45 UTC — Message 56/70
It takes a maximum of 1 hour.We are well aware that you are a representative of the recovery company and want to earn yourself.But in fact you are damaging your clients and yourself as a negotiator
[lockbit3.0] — 16.02.2023 09:27:18 UTC — Message 57/70
[REDACTED URL]
[lockbit3.0] — 16.02.2023 09:28:12 UTC — Message 58/70
You have time to think about whether to drag out the negotiations further, or pay up and close the matter quietly.
[Newbridge] — 16.02.2023 14:25:40 UTC — Message 59/70
I'm not part of a recovery company. We are trying to work with you. Once you publish our data there will be no point in talking with you. I will check with my team on the status of getting more sample files.
[lockbit3.0] — 16.02.2023 14:29:44 UTC — Message 60/70
don't care! you won't scare us with this. you've been taking too long, whoever you are. your name will be published first, and then only your details. if you don't pay, others will pay. our patience is over
[Newbridge] — 16.02.2023 23:08:52 UTC — Message 61/70
[REDACTED URL]
[lockbit3.0] — 16.02.2023 23:15:45 UTC — Message 62/70
ok, wait
[lockbit3.0] — 18.02.2023 11:23:28 UTC — Message 63/70
File: [Quality Management Coordinator 12.1.2017.pdf.7z]
[lockbit3.0] — 20.02.2023 12:26:55 UTC — Message 64/70
when will you pay?!
[Newbridge] — 21.02.2023 14:12:04 UTC — Message 65/70
My leadership is going to meet to discuss this.
[lockbit3.0] — 21.02.2023 14:13:48 UTC — Message 66/70
Hurry up
[Newbridge] — 22.02.2023 16:04:18 UTC — Message 67/70
The leadership meeting has been delayed due to something beyond our control. Thank you for your continued patience with us.
[lockbit3.0] — 22.02.2023 16:09:54 UTC — Message 68/70
If you hope that by delaying negotiations you will lower the price, you are mistaken
[Newbridge] — 24.02.2023 15:11:12 UTC — Message 69/70
I am not trying to delay negotiations. I have not heard back from the board yet.
[lockbit3.0] — 27.02.2023 06:23:24 UTC — Message 70/70
it's time to pay