// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Bakker Heftrucks
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Bakker Heftrucks. The negotiation consisted of 27 messages exchanged over 2 days, beginning on 2022-09-12.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Hallo, I would like to decrypt a file
We would like to get back our files etc. Our personal ID is 0384F759C4124EF970C8201B0AE06EBD. What are you're instructions to get our data back ?
Hello, the price for your whole network is 100k USD.
We have steal, malbox.edb and all your users files, If you don t pay we will public them, take in consideration we don t have what to do with them..
The file you tried to decrypted is too big, try with a smaller file. I recomand a .jpg
Hello, I consulted this number and this is not a realistic offer. We have backup and are able to restore, this is going to take some time and money. We are willing to pay 5k.
If you have backup, why are u here? I deleted ur nas myself, ur altaro saved locally not cloud
We have older backup files on external devices
Come with a better offer than 5k
So we are here because it's going to take time to restore those and enter the missing data
Come with a better offer. 5k i will not accept it.
I have to consult but I think they won't accept anything higher
You are from the it company ?
They hired you to speak with us? or what ?
yes we are
I consulted with the customer and they can pay 6k, this is maximum, they cant pay more.
As we said, no midleman.. because in the past they fuckedup our negotians.
6 k not gonna happen.
give us a normal number than
Normal ? 95k usd
Final offer: 10k or we will begin restoring the backup that is offsite. You can respond till 15:30 CEST
The lowest we can go, 60k, have a good day.
good luck men
ty
We accept 15k euro! last and final price.
10k"
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.