// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Software Line
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Software Line. The negotiation consisted of 30 messages exchanged over 4 days, beginning on 2022-09-08.
The initial ransom demand was $100.00. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
hi
there are someone
please
how can i decrypt my file?
how i can pay?where?
hi
to decrypt the data and avoid publication you need to pay us. we haven't published your name on our blog yet
how much pay?
$100k
too much
and i m not sure that you decrypt my file
we have a test decryptor, you can try. just use it correctly
max 50kb my file are more big
then use another file
100k$is too much my company is small
you'll have to look for money. not that small a company. we know who you are
I'll give you advice right away. we don't like whiners and negotiators. we are serious people and we have a reputation and we came here not to play and not to joke. so pay and be free
for us is too much if i pay 100k if i pay i can close my company, i know you are serious
i can pay max 10000$
how i can pay?
ok! i speak with ceo and we pay 100K but how pay?thanks
we accept payment only in BTC
wich address?
bc1qpgggs7j546rfavshtckq4v8x4fh87zztaqw5zz
sorry i open account on exchange but i can't buy 100k in btc, i can only send you 10k in btc otherwise financial company control me and block my company
if you want i send you 10k in btc otherwhise i prefer lost and close my company
use brokers. we will not accept 10k
you're funny
will you pay? or should I publish a post about you?
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.