// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — QSI-Q3
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with QSI-Q3. The negotiation consisted of 20 messages exchanged over 4 days, beginning on 2023-01-25.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Good morning, you encrypted some of our machines.
Hello, you pay - we give you decryptor.
What about our data?
after payment you will receive a decryptor and all copies of the data will be deleted from our servers
what did you steal? and what amount of money are you looking for?
we copy 30Gb data. file listing only after payment. Price for yoour company is 400k USD in Bitcoin or 380k USD in Monero
Why would we believe you without any proof? At first you only mentioned teh decryptor.
You think I didn't take anything from your network? Why do you need proof if your files are encrypted? Obviously, I took the files when I was a guest at your place.
File: [1.png]
File: [2.png]
File: [3.png]
File: [4.png]
Ok we checked with the people who know that data. That is not critical. And I saw, that you deleted the decryptor, so you can't decrypt anymore?
Decryptor will delete at - 2023-03-16 22:04:06
Decryptor not deleted.
Now it shows correctly. Thanks. So to be frank. The encryption is not really an issue. The lost data might be. However, as I said, the data above is not critical. Management will need something better.
Ok, we will be prepare your database for public
your data is huge. the screenshots above are examples of random files. but what will be critical for you - may be in the total volume of data. Are we going to negotiate further?
[REDACTED URL]
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.