// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Scohil
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Scohil. The negotiation consisted of 29 messages exchanged over 17 days, beginning on 2022-07-15.
The initial ransom demand was $120.00. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
How much is it to decrypt my files
Hello?
I was just checking to see how to get my files back
All operators are busy at the moment, please wait for an answer.
Hello
To decrypt your files and prevent us of destructive actions against your company you will need to pay $120 000 . We also have all your files.
One hundred and twenty thousand dollars?
yes
There is no way my customer can pay that. That is an insurmountable ammount of money.
We take into account your profits and the amount of work needed to encrypt your information, that's how the sum is calculated.
What would you like to offer me?
Anymore than 8,000usd would bankrupt my company, and then I would lose everything anyway.
Well, this isn't true. Even by public official data about your revenue it's obvious that you are capable of paying 120,000$. You may make your own offer about the price but it shouldn't differ from mine by a large sum.
Well I have some good news. There was a backup we found that you did not get to. So we will not need your services.
We will sell your files.
You do not have my files
Why are you telling me this information about another backup copy?
You didn't even ask for proof about the files we have acquired. The information about an attack on your company will spread like wildfire on the Internet when we publish it. You will most likely pay a fine bigger than the sum we are asking for.
If you have the files then prove it.
Ok. It will take some time. I will send you a list of files soon
a list a files is not proof of anything .. that just means you Looked at the files. the connection my customer has is complete crap and no way you transffered that many files off of their server... Proof would be showing me screen shots of the files you have
Good. I will send you screenshots of several files.
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]
[REDACTED URL]
Have you made a decision?
[REDACTED URL]
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.