// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — PS Energy
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with PS Energy. The negotiation consisted of 25 messages exchanged over 16 days, beginning on 2023-03-29.
The initial ransom demand was $2.0M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Hello, can someone please help us? We've received some calls telling us that our company is posted on some website. We need to talk this through with you but that posting has to be removed before we do.
Hi, yes, we can help. We'll delete the post now.
Post deleted. To decrypt the data and avoid publication you need to pay us.
How much?
$2,000,000
We will send you a tree of some of your data that we have downloaded. Select a few files from the list and we will send them to you as proof.
We need to see everything that you took, before we even consider that amount.
Download link: [REDACTED URL]
Password: dmCjKu!4oTDl5X@7#OZWI9ESh
The entire list of downloaded data is kept confidential so as not to violate the privacy of the company and the data we downloaded. We do not know exactly who we are negotiating with and will not disclose such information.
time to pay
can you provide these files?
PSE DIRECT DEPOSIT FOR CLIENTS.pdf, Card List 062818.xlsx, AR Aged Trial Balance Xcel Voyager through 08.26.2021.pdf, ReportsDownloaded181219125827.zip
yes
[REDACTED URL]
time to pay
We'd like to pay but you have to understand that the number you're asking is totally out of reach for us. We dont have that kind of money, we're just a small privately owned business. We can't afford anything near that number.
We know exactly what kind of company you are, we have studied you. In addition, we have a lot of your data. You are a multimillion-dollar company that can afford that amount. The only question is whether you are willing to pay damages and losses after your data is published. If you continue to negotiate like this, we will go nowhere and we will be forced to go public.
We're not sure what you're looking at, but we have not been doing as well as we were in the past. $2 million isn't something we can afford to lose, nor something we have on hand. We want to make a deal and still need your help with our files, but if we could work towards a more affordable price that would really help things move faster for both of us.
And we are not sure of your interest in making a deal.Therefore, we will not give you a discount at this stage.
We also are not sure of your interest in making a deal, we've stated several times that we can't afford $2 million yet you haven't been willing to provide us with a lower number.
Then change the negotiator or invite a more interested person in resolving the issue.Who will not waste time.It is extremely stupid to ask for a discount on nothing, not offering anything in return.Right?
You want a discount, we can give you a discount of 1%. It's a good discount. And the amount will be less than $ 2000000, pay. You have achieved what you wanted. The next step is up to you. Waiting for payment \
when will you pay?
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.