// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with PRE Flooring.
The negotiation consisted of 17 messages exchanged over 4 days, beginning on 2022-07-22.
The initial ransom demand was $200.00. The victim refused to pay.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[PRE Flooring] — 22.07.2022 18:14:05 UTC — Message 1/17
[Chat started]
[PRE Flooring] — 22.07.2022 18:27:56 UTC — Message 2/17
Hello
[PRE Flooring] — 22.07.2022 18:29:27 UTC — Message 3/17
Hello, our files have been encrypted. We would like to discuss getting a decryption key
[lockbit3.0] — 22.07.2022 18:35:56 UTC — Message 4/17
Hello
[lockbit3.0] — 22.07.2022 18:38:56 UTC — Message 5/17
To decrypt your files and prevent us of destructive actions against your company you will need to pay $200 000 . We also have all your files.
[PRE Flooring] — 22.07.2022 18:43:16 UTC — Message 6/17
I will inform the management
[lockbit3.0] — 22.07.2022 18:44:14 UTC — Message 7/17
ok
[PRE Flooring] — 22.07.2022 18:46:01 UTC — Message 8/17
Domain controller password does not work now. Did you change that password
[lockbit3.0] — 22.07.2022 19:20:03 UTC — Message 9/17
Yes. We will return all of the information after the payment.
[lockbit3.0] — 22.07.2022 19:21:04 UTC — Message 10/17
Also, you will receive recommendations on how to improve the security of your network.
[PRE Flooring] — 22.07.2022 22:12:40 UTC — Message 11/17
Management received a direct call to cell phone. Caller stated he was you. Stated ransom was $500K. Management spooked. Can't pay that much. Business is a small business. Is your group fragmented or something? Management doesn't know what to believe now.
[lockbit3.0] — 22.07.2022 22:25:37 UTC — Message 12/17
How did the caller introduce himself? When was the call? How did the caller suggest to contact?
[PRE Flooring] — 22.07.2022 22:40:04 UTC — Message 13/17
I was not part of the entire call and don't know how call introduced self. The call was around 4PM ET. He never suggested contact because management would not agree to any price since numbers so high. Advised management that this venue showed only proof of decrypt.
[PRE Flooring] — 22.07.2022 22:40:52 UTC — Message 14/17
Management cannot pay anywhere close to 6 figures. Just not there to pay and have no insurance.
[lockbit3.0] — 22.07.2022 22:49:05 UTC — Message 15/17
I will clarify all the information and answer you
[lockbit3.0] — 23.07.2022 16:58:14 UTC — Message 16/17
The price for you is 200,000$. There will not be any extra payments or charges, that's the final sum. We always follow the said conditions, as it's crucial for our reputation. After you have paid the sum, we will provide you with a decryptor for all of your files and also delete the downloaded files from your network on our servers. You will also be provided with a full report on vulnerabilities within your network and given recommendations on increasing the safety of it. We guarantee that all the steps above will be fulfilled by us.
[lockbit3.0] — 26.07.2022 14:34:22 UTC — Message 17/17
Have you made a decision?