lockbit3.0 Ransomware Negotiation — TAPCO Credit Union

[Chat started]

Hello. We received your note. Can you please tell us your demand and send us the file tree of data taken. Thank you.

I am the IT manager and the only one that can use TOR

Where did you come up with this number. I think you have us confused with a different firm.

Our cash flow is under $200K and you are asking 30 times that. We are willing to settle with you but you have us confused with another company. We are willing to pay $50K

Do we have a deal at $50K? Please send us your wallet address. Thank you.

What are you asking for then?

we would like to conclude our business with you as soon as possible

You must have us confused with someone else. You are asking 30 times more than our cash flow. We need a far better number.

Send us the financial documents you are referring to as you are mistaken.

We also received your message on our customer support page today. We told you we want to solve this quickly. You have mispriced us as we are a small financial organization. ZoomInfo shows you our size but that number on revenue is high as well.

As we have said already - we are a small financial firm and your demand does not match our business or what we can pay. Give us a realistic amount and we can settle this quickly.

the onion link is not work for us

You asked for a realistic amount. We gave you an amount. If you looked at zoominfo, you would realize we are mispriced. We are ready to transfer you $50K

We are ready to solve this now.

give me a number to work with then.

Do you understand me, obviously not. You are asking for 30 times Net Income. Our total revenue is below $10KK. Look at zoominfo.

You have us confused with some other firm

As I have told you, we are willing to settle as quickly as possible if you give us a realistic number

Yes.

Are you not understanding financials. Let me help you out

You have 2019 numbers, not 2022. Also Revenues- Expenses with the numbers you have listed, which are not correct are only equate to under $1M. Are you telling me you normally ask a company to pay $6M on under $10M in revenue with Net Income a little over $200K. I have no idea how any company would pay you.

After you take out all the EBITDA and expenses, yes. Look. we want to work with you but what you ask is impossible to give. Give me a workable number and we will come to terms

why does you site say socket connection issue

you are under DDOS by who

ok. know I understand why socket connection issue.

i understand. well, we are not attacking you. We just want to get to a solution and move about business

I am really trying to explain it. We do not have what you want. You are asking for 60% of revenue. You really extort companies for 60% of revenue. So you would charge a company that has $200Million of revenue $120Million ransom.

You are working with bad information on us. so either reprice us and come to something reasonable or we are not going to have much to chat about

That is not our money. I am sure you have a bank account somewhere. The bank cannot give your money to someone else

Why would lie to you. I just want to get to a solution and then move to fixing our network.

If you give me something to work with, I can see what I can do here

Well, enjoy then. When you return, can we get to a solution.

We want to get to a deal as quickly as possible. After discussions with the board and reviewing our financials, we are looking to increase our offer to be between $250K to $400K. We want to settle today so hopefully you can understand our position and we can close this deal. For the amount within the range, we would like the decryption software, support for it, you said you had data of ours so we would like a listing of the documents and some type of deletion log to prove you no longer have it, explain how you got into our network, and to never attack us again. We look forward to your positive response.

Not trying to be brazen nor misleading you. I am trying to provide the facts to you that your demand amount is not realistic for a company our size and if you would work with us, we would settle this todayh

I want to decrypt our network as quickly as possible and want to do a deal. Your starting number is not manageable for a company of 100 employees. If your number would have been in the $250K to $400K range, we would have paid you right away.

so let's talk about paying you right away. Can we get a reasonable number so you can go enjoy your weekend

can you proivde the partial file tree while I caucus with my board members

As a credit union, we are a not for profit and the number your reference in not our money. We hold money for indivuduals in their accounts in their name. We cannot use this money.

I don't know what you mean by our time is up but we are negotiating in good faith. Our board is willing increase it's offer range to $650K - $750K which we can pay quickly. Publishing our data does no good. We are here trying to resolve this. You think we have more money than we have and we have asked you to consider we are a not for profit credit union and the assets you reference are not ours.

We are under 100 person firm. The assets you reference are not ours. If you are financially motivated we have given you a reasonable offer and most victims on your blog have amounts fall smaller than the amount you want and are larger organizations.

We want a deal as well but remind you we only hold money and it's not ours to use under any circumstance by law. The money that is ours cannot be used for non-banking expenses by law and what is left over after that is very little. We simply don't have the amount of money you demand but have offerred you a tremendous amount of money. Take this deal and let's end this.

We are here when you want to do a deal. We have funds to pay just not in the range you are asking for.

Hopefully then boat trip was relaxing on your end. We are ready to close the deal at 750k as we were successful in securing funds. Let's close the deal and both of us can enjoy the rest of the weekend. Thank you.

You said you were going to send us the files tree. Can you please send the partial tree. Thank you.

Our NET Revenue last year was $3 million. The document you provided has our clients’ money and we only hold the funds. We cannot access the funds as only our clients can. So, when we pay you in BTC it goes into a wallet. Your wallet is likely held at some brokerage firm. The brokerage firm cannot access your wallet and take that money. They are just holding the money and you are the one that controls it not us. When we report to our regulator, we must report the amount of funds we are holding. Again – this is loans and deposits that we cannot use and is reported to regulators. We are offering you 25% of our Net Revenue Number of $3million. $750,000 is a sizeable sum. We want to get to a deal and will pay you quickly. So, hopefully you understand that we do not control the $500,000,000 number as it controlled by our members. We only can control the $3 Million Net Revenue Number and we are offering 25% of that sum. I do not know if other organizations are giving you this amount of their Net Revenue. We are a not-for-profit credit union. Please understand that we want to settle and will pay you with funds we can control. Can we conclude our affairs and move forward and pay you what we control.

No one is trying to trick you and we are not pissing in your ears. Your accusations are unfounded as we are audited by regulators every year. We have tried to explain our business model to you and you seem to not understand. We are a not for profit credit Union and our net revenue last year was $3M. Our records are public and you can look them up. We have told you we will give you 25 percent of our net revenue, which is 750K. We have been through your blog and companies with larger revenue than we have are charged less than you are asking from us. We are willing to sail in peace just modify your understanding of the situation and we will pay quickly.

The below link is from an independent source which confirms our net income of $3,593M for the year, which you can see on page 7 of the report. This is the money we have available to settle our affairs not the $500M in customer loans and deposits you continue to reference which you can see on pg.13 of the report and which isn’t hidden from the authorities as you claim. Please accept our offer and let's settle this once and for all. If you are financially motivated, then give us a realistic number as you are already receiving 25 percent of our net revenue. [REDACTED URL]

In good faith, paying you $1,000 to extend the leak clock does nobody any good. We cannot pay $5M and we have tried to explain this to you multiple times. Our net income is $3M. It seems like we have hit an impasse in our discussions. We do not understand how you can in good faith ask a company to pay more in net income than they made. It seems you want our business to go under. From a business perspective, we all win if you would lower your number and we sail our separate ways. If I could raise the amount to $1M, will this be enough to satisfy your demands. If so, I can talk further with the board about how to raise the additional amount.

The board has communicated that we only made $3Million in Net Revenue last year and provided you third party references on it. We do not control the $500 million that you continue to reference as that is our client money. Publishing us does no good on either party as we are both motivated to get to a solution. What other information can we provide you to demonstrate that we do not control the $500 million and only control the $3M. We are only a 100 person company.

Look at the public record documents we sent to you in the last few messages. It lays it all out in financial details. I do not know what else we can provide you. that has all credit unions listed and anyone can access it.

We just want to understand your position in that you will walk away from a million dollars which is 33 percent of our Net Revenue for payment of a decryption key.

• You continue to misinterpret our records, and this has drawn out our negotiations many days. We have nothing to hide in our financial records as they are public and regulators, third party auditors, investors, and others can view them at any time. The link we provided shows this. Now, Bluff 1 shows our cumulative net income for the year at $3.5M as of August 2022 (Cumulative means from January to Today), the prior month’s income rolls forward and we actually lost money in August. Bluff 2 shows the cumulative year-to-date income as of August which is included in our $3.5M earnings to date and not a separate income number as you incorrectly assessed. All our Financials can be found in the Accounting Drive, Board Reports folder by year and month. The balance sheet and income statement in the folder provides the financial picture. While you review these documents, please delay posting our information to your blog which will harm our negotiations. After you have read the documents, can we conclude our business. We just want to understand your position in that you will walk away from a million dollars which is 33 percent of our Net Revenue for payment of a decryption key.

Now that you understand our financials. Can we settle and we will send you 1 million.

In exchange for $1M we will receive all decryption keys, support, proof of data deletion, and a detailed explanation on how to broke into our system.

Also, how long after payment will we receive the decryptor?

Ok, so you are saying we pay $1million for the keys and support. And if we want the data back, that is another $1Million and the security report is $1M.

I appreciate that you have given us options here. Need some time to discuss with the board and we have different time zones on what the meaning of send it today.

you realize we are on PDT not EDT.

When we structured this deal, it was supposed to be a package deal. On the data, can you provide us a file tree

If we are going to pay you this evening, can you stay online with questions that we have

We want to meet your deadline but need a few answers from you. Thank you.

Are you there. We are working on acquiring the funds you want for the decryptor. Can you answer a few questions

Yes. You should wait. We receive the decryptor along with support. Wallet is confirmed as bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd

We are ready to go once you confirm the wallet

We have four hours left per your instructions.

Thank you. Stand by.

We receive the decryptor after payment along with any support. Correct

We have sent payment

we are at 2 confirmations now.

The tranactions has been confirmed. Please send the decryptor.

The Decryptor is not working properly for files in some locations of the computer such as "C:\Program Files", "C:\WIndows" folder and more locations etc. can you give us a new decryptor which works on all the files on the system?

We are running the tool as System Administrator and have an issue - The Decryptor is not working properly for files in some locations of the computer such as "C:\Program Files", "C:\WIndows" folder and more locations etc. can you give us a new decryptor which works on all the files on the system?

Stand by

File: [image (1).png]

We’ve also tested copying encrypted files into multiple folders deep with all permissions changed to full access to all users,everyone,domain users, etc. The decryptor does not decrypt anything outside of the folder that it’s located in.

i will acquire the items you are asking for

Windows 11 , MD5 hash of LBB_Decryptor.exe: 5cb062a9833428b118121b987099cc28

can you fix the file path on the decryption so it will run everywhere or does it have a command line that we can point it to

please let's know what else you need so we can work the problem and fix our network

any update on this.

File: [decrypt_tool_fail_log.txt]

We would like to be one of your successful companies and never chat again if the decryptor worked as we thought it would. We have no reason to lie as we paid a significant sum for it. We will create the video. We did create a log file that shows when the decryptor run that the files do not decrypt.

We are getting close to decrypting all files but have some issues with these last remaining ones. We can't post to the chat because the file is too large. Here is our link to the files for you to take a look at. Thank you.

[REDACTED URL]

Yes we will get you the video with the system files being ignored soon, meanwhile we were able to use the commandline version of the tool and --path command and point it to specific paths to fix the issue where the GUI was ignoring some paths. The sample file sent is a file where the decryption failed no matter the path the file is located at

We are getting tired as well from the circus. We were able to make strides in decryption. however we hit a snag and wanted your help. We will get the video to you

We would like to understand the data you have and you promised us a partial file tree. If you can send us the partial file tree, we will discuss the amount you want with this

We appreciate you taking your time with us.

Link to video: [REDACTED URL]

We told you we could not decrypt and were showing you the issue as the decryptor would not go down to a folder level. We finally figured it out however another issue come up with the file we sent you as it will not decrypt.

We are willing to pay if you can produce a file listing. So are you producing one or not?

we told you - show us the file tree