// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Bank BSI
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Bank BSI. The negotiation consisted of 27 messages exchanged over 7 days, beginning on 2023-05-08.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
give me proof that you have comptomised us
Hello.
We have about a terabyte and a half of your customer data
ok how do we know that
We can provide you file tree of stolen data
let me see that
You choose any two files of no more than a megabyte from the ones we stole and we can give them to you.
you dont even know who's data you have stolen
show me that customer data you think you hv stole it
File: [banksbitree.zip]
File: [proofs.zip]
BSMCOLLECTION Database (check your last backup from it) - a lot of customers data Some interesting from SPM-HESTU - a lot of customers data Medalion Some from Swift
what price do you want?
It depends on your greed, what can the largest bank in the country with multibillion-dollar revenues offer me for a quality pentest of your corporate network?
It looks like you want big things, if that's the case, we'll confirm with other things, do you have a stolen username, password, like a pin or something else?
You will find out about this after all the stolen data is published, in case you do not want to pay for a quality pentest of your corporate network.
ok, can I buy for 100,000 USD? you like?
20 000 000 $
why is it so big, at least give us 1 sample username and password you stole we will take it at 10,000,000 dollars
Your competitors and scammers will be looking for logins and passwords in the databases after the data is published.
So is there anyone else who wants to buy it?
We will not disclose this information.
An example of a login to the Internet banking.
202194016611 20Darkstar94!
Would you be more comfortable paying in bitcoin or monero?
Be a man, promise - do it.
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.