// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Royal Mail
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Royal Mail. The negotiation consisted of 103 messages exchanged over 28 days, beginning on 2023-01-12.
The initial ransom demand was $80.0M. The victim refused to pay.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Hi. Did this work?
hi
i'm here
[REDACTED URL]
tree stolen data
password @fA@KM@YY(X2%Z%tbvHn%re2a
Now I am worried about the other link with data in the other chat. Is that link gone now? so no one sees it
If you have already downloaded it, it is no longer available
Thank you.
Is this showing all the data you have taken from us?
the link is not available, did you download the tree or download it again?
Yes, all stolen data
I did open it and download a file from it. Is that the data?
there was a tree of data stolen from us at the link. you can select some files, we will send them to you
I will open the file and show it to my management
Yes, don't delay. time is not playing in your favor. so far we have not reported the attack on our blog
to whom am I speaking?
I work in our IT. Our senior management have asked me to contact you as it said in your note
ok
what does management say?
Hi. I gave them the file. I am still waiting for them to come back to me.
ok. hurry up
We shall return to speak on Monday following the weekend and lengthy discussions with our internal stakeholders.
Try to spend them productively, and please us. our patience is not infinite
what can we expect by monday?
We will let you know
ok
Hello. We waited the time you asked for. Now it's time to pay.
Apologies for the delay as this is a lot for us to deal with. We shall get back to you tomorrow with some file names from your large list to request to see.
File: [requested_files.txt]
These are the files we would like to see that you have
[REDACTED URL]
pass pMjd07L82^VYVexJyF6etQZ31
Hello, it's time to pay.
What do we need to test your decryption ability with our files?
each machine has its own ID. In order to decrypt the file you need to take the file from one PC, and go to the chat with the ID of this PC. then the test decrypt will be successful
Okay, we'll see what we can do to identify the ID from each. Will come back to you.
Also you can send me 5-10 files, I will decrypt it for you
Use this sites File Share: lockbitfile2tcudkcqqt2ve6btssyvqwlizbpv5vz337lslmhff2uad.onion lockbitfilzhrvt6eya2lvnp7te4iifzmwybendqclgujqbzu3k4gaid.onion lockbitfilzu5e62fybhieutf6653cpv6wco7twgjtkqwdgubn4q5rad.onion
Think I did this right. Here's some files: [REDACTED URL]
I also have a 6 GB file that is very important. It's associated with medical devices that can't yet be shipped out because this file is locked. Please please if you can unlock this too it will help save lives. I don't know how to send it over
File: [1.png]
File: [2.png]
File: [3.png]
File: [smh_installer.log.7z]
File: [WindowsUpdate.log.7z]
You gave me valuable files that can help restore your systems without paying for a decryptor, so I only gave back some of your files, and screenshots of the valuable files.
About 6 gigabytes of data that will supposedly save someone's life, is it one file weighing 6 gigabytes, or is it many files weighing 6 gigabytes in total? Something tells me that you are bluffing and you are doing system recovery and want to get free decryption of critical files needed for recovery. Tell me in detail what the medical equipment is and what the 6 gigabyte files are.
There are 2 files that are a combined 6 gigabytes when compressed. You know how much of our data is encrypted and when you see the files, you will understand that they will not allow us to recover. We are only pressing this because of the medical concern and we do not believe that your intent is to hurt anyone.
What are these files? What is their function? What medical equipment are these files for? And what does the postal service have to do with medical software? Where is the logic?
We are not just a postal service. We handle both letters and parcels, where roughly 60% of our business is parcels - international export of global medical supplies, contribute to a significant element of that! These supplies include vital replacement equipment parts, COVID-19 test kits, prescription drugs etc. The files that we have provided should allow us to resume shipping some of this equipment, not only here in the UK, but globally as well. Our transportation of this medical equipment does play a vital role in ensuring that people in need are being helped by these products. Given that the files are renamed, we are making our best assumption that this is the right dataset, and we would greatly appreciate the assistance.
If you pretend that you do not believe that the decryptor really works, you can send me 10-20 other less important files, e.g. not related to virtualization systems and not containing RAM dumps, you can send me personal documents, photos, and many other things that do not help you without paying for my postpaid pentest services. If you were really worried about medical equipment, just pay for my work and get a decryptor within 5 minutes. You are making multi-billion dollar profits from your business and don't want to part with the money, don't you think that's odd? It's your greed that makes the people who are waiting for their packages suffer.
We are not pretending anything and apologise if it appears that way. It is just that my management have heard that your decryptor might not work on large files, that is why they asked and wanted to see if it did. I am trying to convince them to work with you here, they are just asking for more proof of what we will get from you. As you probably know, we are already a loss making company, so we are not gaining anything from dragging this out. There are several articles on Google about our financial situation and how bad it is currently.
You can send me other large files, I will decrypt for you those files that I think are not valuable, that way you can be sure that the decryptor works on large files. Your financial situation is fine, you have a multi-billion dollar turnover, and a huge profit, the sooner you pay, the sooner this whole nightmare will be over for you. If you continue to stretch time I will be forced to publish your information on the blog with an offer to change negotiators, thank you for your understanding.
We are collecting some larger files that are not valuable to provide you. It's important for us to understand these can be decrypted of course so we appreciate you providing that opportunity to us. Ahead of this, we haven't even heard from you what it is that you want.
I'm waiting for the next batch of files to be decrypted. We want as 0.5% of your revenue.
And how much is that?
How much your revenue?
All we have had is losses. Here, you can read about it yourself. [REDACTED URL] [REDACTED URL]
We understand you very well, we are all suffering from the global crisis and our income has fallen as much as yours, anyway you are hundreds of times richer than us. 0.5% of annual global turnover is much less than a 4% fine from your government.
Just name the amount already so we can let the leadership know.
$80 million is 0.5% of your revenue, $640 million is 4% of your revenue. We are asking 8 times less than your state. In addition to this price you get a decrypt of your data.
Do you really think the government doesn't already know about this? Even if they were to fine us, paying you or not does not change this.
We'll get you the files and we can continue these talks later.
As long as we haven't published any of your files, you can't be fined. If you can negotiate with us, the government will be left without your $640 million. It is much better for you to negotiate with us and continue your very successful business with a long history and impeccable reputation. I personally used the services of your company and was very satisfied. I wouldn't want you to suffer so much from the government.
Talk to you later
Ok
How do I give you these large files? They are larger than your 2GB limit
My internet does not allow me to download such huge files, my internet speed is 50 kilobytes per second, send me files up to 50-100 megabytes at most. At the same time I can offer you to do the following, I will create a build of the encryptor and give you together with the decryptor, you will encrypt any files on your virtual machine and this way you can check the successful decryption of files larger than 2 gigabytes.
Okay, I guess we can try that. We just want to have confidence your decryption tool will work on these large files
You don't have to worry, thousands of people have successfully decrypted their files for almost four years.
I believe you, but we need to see it ourselves before we can consider this
[REDACTED URL]
Encrypt any of your computers or virtual machines, any amount or amount of information. Write to me via a note and I will give you a decryptor in a new chat in which you will write to me.
To start the encryption, simply run the file as administrator.
There is still some confusion over who we are, you are basing your revenue on what is a holding company and not Royal Mail Group. IDS (International Distribution Services) have several companies that exist under that umbrella who are independent to each other. We are Royal Mail International who is a separate entity, with an entirely independent Managing Director and Senior Official. Our Company’s revenue is in decline, as we have tried to explain to you previously and Royal Mail International is the Company that is affected by your penetration testing. Our current financial turnover is expected to be 800 million. Based on your calculation for payment (0.5% of total revenue) this equals 4 million dollars. If there is any negotiation at this percentage level the starting figure needs to represent what I have just described. I am trying to help our Senior Team understand this and I am grateful that you have offered to help them see that your decryptor can work to restore our services, by offering to decrypt some larger files. We will have to accept what we have for now and will see if this is good enough for them or not..
You're bluffing, 800 million is your net profit per year, so 80 million is not that much money for you.
What company are you looking at to get those numbers?
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAHuwwya8Vr_ETqomIFym90OHoOGvCLlLONYPwCbLmCiF19qs4A2x68Rge0ICtwVtRfnOeQIctYx5A0epfJT5t2u73JkDFGhBtrJFtpwWWlf3Y_Qbxtj8aL5TcfVxyrg_tvh7vJNNb3y9Ex0WXLu5iuj7visZOGG5yE8wufn912Bq
Trying to explain we are Royal Mail International, who is a separate entity, with an entirely independent Managing Director and Senior Official, and not "Royal Mail" as the overall entity. What you attacked is just a small portion and our revenue is not that of Royal Mail.
Anyways, time for bed. The board has meetings this weekend and we will not have anything new to speak about until Monday while they make their decision.
You are a very clever negotiator, I appreciate your experience in stalling and bamboozling, when you are trying to deceive you need to provide evidence for greater credibility, only a fool would believe in the honest word of a lawyer defending his client.
Not here to deceive or bamboozle. Just being transparent about what we're doing. The board having meetings this weekend shows our seriousness. Please confirm you will wait for their decision on Monday
Your seriousness can consist only in a desire to pay 80 million dollars, all other promises of meetings of your management, which allegedly will be held, this is just a tactical move, increasing the time of negotiations calculated that I will be nervous and agree to a smaller amount of money that you will offer. I am ready to wait until Monday, I am sure that your directors have more than 100 million dollars on their personal cryptocurrency wallet, so it will not take much time to finish this nightmare.
As we informed you, we have a response from our board to provide you. Under no circumstances will we pay you the absurd amount of money you have demanded. We have repeatedly tried to explain to you we are not the large entity you have assumed we are, but rather a smaller subsidiary without the resources you think we have. But you continue to refuse to listen to us. This is an amount that could never be taken seriously by our board.
If I did not want to make a deal with you, your data would have already been published and the decryptor deleted. I am not forcing you to prove anything, I just kindly asked, refusing to give me such simple information says that you do not intend to cooperate with me honestly and tell me the truth. We are not attacking critical infrastructure, your commercial mail company with dozens of similar competitors is not. If you believe the news that your management is releasing, your mail services are fully restored and you are functioning as you are, humanitarian and medical supplies will be successfully delivered by your competitors, you will just get a little less profit, because you are very greedy and don't want to pay for my services. I'm sure you could easily pay $80 million, your income allows you to do so. If you want a discount, then make a counter offer, we are here to have constructive negotiations, not for me to give you a discount after every bluff you make until you say I'm fine with getting a free decryptor and free removal of stolen information. Any specific offer you make will be considered. You have a chance to make me an adequate payment offer by consulting with your board of directors, whose salaries are in the hundreds of thousands of pounds, but that does not stop them from being very greedy and not making concrete proposals to save the reputation of your commercial company which has more reasonable competitors who have already paid us money and successfully continue to earn new excess profits billions of pounds. Good day gentlemen.
I am still trying to work with you here. I am trying to get the board to find a solution with you, but they have two major concerns. You haven't showed us that you could handle the large files, and your starting point here is way too high. We have told you who we are, and our numbers wouldn't at all justify the demand you have put forward. I am doing what I can to drive things forward on my end, but your demand is simply too high for the board to consider. If you can give me a lower starting point, I think I may be able to get the board to work with you. I really want to find a solution here, please help me do that.
I'm ready to help you, I want to make money just like you, you and I have the same motivation in the form of money, your task is to reduce the price as much as possible, my task is to get the maximum amount. I have shown you that I can handle large files, you can encrypt and decrypt any files you want, why haven't you done that until now? The price is based on a multi-billion dollar company's profits, it's not the case that a company making billions of dollars pays the same price as an ordinary company making tens of millions of dollars. The more profits a company makes, the higher the buyout price, that's the math, you and your board of directors should understand that. Out of respect for you, I'm willing to step up and give you a 12.5% discount.
Thank you for this. I appreciate you coming forward like this. I will bring this to my management and get back to you.
Ok.
I just want to let you know, that I am still waiting for a reply. My manager told me, that he is waiting to hear back from the board. He has promised me I’ll get an answer on Monday. I will let you know as soon as I hear anything.
Very long, the company from the UK paid on the second day after the attack because they care more about their business and reputation, strange that for you it is not so important, because you make a lot more money.
Maybe you didn't ask them for such a large amount. That would probably make it easier to pay quickly. My manager hasn't gotten an update from the board yet, can I check back in with you Monday?
Naturally, I asked them for a smaller amount, their revenue is 58 times less than yours, they earn money 58 times less than you, I always ask for a fair and adequate amount from each company, I do not ask for what the company can not pay. Why do you have such a long chain of middlemen? why can't you communicate directly with the director? I will wait until Monday, but I think it is time to end this case. The journalists are asking me why I haven't published your information while I ignore their questions, they really want to see your files.
You need pay.
[REDACTED URL]
You have 50 hours for payment.
I just want to let you know, that I am still waiting to hear back from my management. It is not a quick decision for them, and I can’t just tell the board to hurry up. To be honest with you I have heard that they might not want to pay you for this. In our perspective the files got leaked when you took them from our system, and paying you won’t undo that in any way. I will get back to you as soon as I have further news.
I just want to let you know that the data is ready to be published and the decryptor is ready to be deleted. You have had plenty of time to make your decision, your time is up.
Do you have any offer for me?
// Analysis
Analyst Observations
- This is an unusually long negotiation, suggesting extended back-and-forth and significant engagement from both parties.
- The initial demand of $80.0M places this in the upper tier of ransomware demands, typically reserved for large enterprises.
- The victim explicitly refused to pay. This is a definitive outcome that typically results in data publication.
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.