// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Guardian Analytics
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Guardian Analytics. The negotiation consisted of 27 messages exchanged over 28 days, beginning on 2023-01-23.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
You encrypted our network, what are you asking for to decrypt?
And we also downloaded data from your network
ok, so what are you asking for?
500000$
Can you provide us a list of the files you took to prove you actually have our data?
ok wait
File: [GUAR.txt]
this is a small part tree of the stolen data . we will not send a full tree, so as not to violate the confidentiality of data. You can select multiple files from the list, we will send them to you, as proof. please note that the lines in square brackets are folders and not files
I cannot get that file to download, can you give it to me from somewhere else, its timing out
[REDACTED URL]
ok thanks, I was able to download that one
Have you checked out the files?
we did but ther are only a few files in that list, we arent paying you anything for like 15 files, none of those files you showed us have any value to use. Please provide a full file listing
ok
[REDACTED URL]
ggjQNoHymP#y*5W!fqu(%%Z#2
OK i will take this to my boss and see what he says
OK
[REDACTED URL]
So, we are still looking through the data and will get back to you in a couple of days
In a few days your data will already be published. hurry up
When will you pay? Our patience is running out.
you said we had until the 18th, we are still looking through the data. This not easy, its alot of data and all we have are file names to trace back to. We also are having trouble figuring out where the data came from to be able to look at it to determine what it is
this is no simple task
you are doing the wrong thing. while you are doing nonsense, we will publish your data. this data was taken from your network, don't you know where and what data is stored on your network? this is very stupid, no one is doing what you are doing now, although we have taken millions of files from some companies
Hi, what's the news?
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.