// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Continental
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Continental. The negotiation consisted of 37 messages exchanged over 41 days, beginning on 2022-09-23.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Hello, Thank you for providing the links and ID to this chat. What proof can you give us that you have any of our data?
We have a lot of your files
Hello
What proof do you want?
Please give us a full file list of data that you say you are holding, and we can chose samples of files from list for you to give us as proof.
Ok wait
Full file list size is over 8GB. we may provide you a partial listing.
Alright, finally uploading. Archiving significantly reduced the size. But I wonder how you will open it.
File list is being uploaded. It takes time. I will let you know when I'm done.
[REDACTED URL]
password conti123
use [REDACTED URL] to review list.
Hello, Thank you for providing the proof of data. It will take us some time to verify the data. We will come back to you as soon as possible.
The list is very large. Hope this won't take ages to review.
Sorry, it has taken us a while to be able to view and start verifying the data due to the size of the file. To prove that you hold the actual data and not just a list of files, we are currently putting together a list of samples we ask you to provide. We will send you the list asap
Hello, okay.
Following up on our message from yesterday, we are still in the process of verifying information. In order to prove that you hold the actual data and not just a list of files, please can you provide the following files as proof of data held: I:\continental2\upload3\did01447\040_QAC_Cleanliness\11_Partikelmonitoring\02_Luftsauberkeit\01_Monitoring\Arbeits-Sheet-Luftsauberkeit_Auswertung Q2 2022 und Sondermessungen.xlsx, H:\continental\upload4_c2\didr1618\MMA_Fahrversuch\06_NVH-DL_Sommer_2022\Daten_NVH-DL_Block1\ATF_10\180622_004\EKB_Data\EEW\180622_004_rl_nr00109_chn0007_eew.wav, H:\continental\upload4_c2\didf3403\Common\Projects\JR-Jeff Ross\Instrumentation Master Database\Archive\Master Database Allentare Fixes March 2016.xlsx, H:\continental\upload4_c2\didb3040\MCAD\ptc\Help\Creo3\help\creo_help_pma\italian\pma\rendering\To_Open_a_Room_File.html, I:\continental2\upload3\hpfs002.tiretech.contiwan.com\HPG-Orga\GCF_TS\PROJEKTE\CT-Mexikana\!Erweiterung 6\CE\Einbauerklärung Elektrotechnik Konwima + Kernsetzer Türkei 2110791.pdf, E:\continental3\upload_c2\did43391\31_ProductDevelopment\40_Software\20_Development\BOT\CPC4_V4_16\pvcs\config\BS_Common_src.arl, F:\continental\upload4\did77091\PROJETS\Radio\RD45\07_MP\02_MP_QualityAssurance\210-Capabilité_equipements\Bizerte\Inspection optique\repetabilité vision SICKconnecteur MOST ilot 1 RD45 BCL tiroir droite.xls, E:\continental3\upload_c2\did43391\99_Workuser\Satvanyi\Boot_v04_16_with Source Address 0x32\config\BS_Appl_src.arl, F:\continental\upload4\didb3019\Konstrukce_Archiv\P-pomocne\P1-1103_Paletka_vytvrzení\Data\(5) Pojistka_výkres.idw, I:\continental2\upload3\did35017\Interior_Innovation_Vehicle\03_Development\05_Hardware\03_Parts_Components\14_HMI_PC\02_OS\Image_WINXPembed\2_Anpassungen-Tools\app\DemoFPK\DemoFPK\msgina.dll, F:\continental\upload4\didb3020\Neplatne_NotValid\Kvalita_Qualitaet\Statistika\Brandys\KS\Vn-Auswertung\2002\11_2002\VDO\Colorado\VnPlovákSest-VDO.xls, E:\continental3\upload_c2\did01155\pua\01_Operations Controlling\2022\01_Actual\01 Reporting\00_general dashboard, E:\continental3\upload_c2\did02299\TM_community_RBG\140415_Documentation_Test_Strategy_Safety_MY16, F:\continental\upload\10Werkstoffe\CR\ROHSTOFF\CC\03\58\02 VULCAN 5H (Cabot, Botlek, NET)\2 - Specification, TDS, CoA
Hello,
[REDACTED URL]
password conti456
Files you requested are uploaded.
Thank you for providing the sample files. We will verify them and come back to you.
Hello, okay.
Hello, we are still in the process of verifying information but it is taking longer than we anticipated. We hope to complete the verification work soon and appreciate your patience. Can you confirm if the list you provided covers all the data you hold?, or was it only some of it? The list did not give details of file sizes. What is the total size of all the data?
Hello. We understand. Yes, the list contains all the data we have. You have never asked for file size information. The total size exceeds 40 TB.
Hello. Your silence lasts too long. You need to pay.
What guarantees do you give if a payment is made?
Hello. Your files will be deleted and nobody will know about the breach if a payment is made. Your files will appear on our leaks site if no payment is made.
Hello, we have to hold a management meeting and will come back to you tomorrow end of business day.
Hello, ok.
Hello, no word from your side though it is a new business day already. You need to pay.
Hello. We've been waiting.
Should we regard your silence as a rejection of the negotiation process?
We're starting to get your data ready to be published on the blog.
Our correspondence will be attached to the post.
[REDACTED URL]
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.