// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — VSA Inc
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with VSA Inc. The negotiation consisted of 21 messages exchanged over 1 day, beginning on 2022-08-09.
The initial ransom demand was $100,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Hi
Hi
The price of the decryptor and deletion of your data is $100,000 in bitcoins. 140gb of data was stolen. At the moment we haven't published your name to the blog to keep the attack secret, but if you don't pay we will fix it! We know who you are and how much you earn.
Soon we will send you a tree of stolen data
i don't have that much money
can i pay $500
Im just a IT guy, they will fire me for this
not enought
I have new Born. i just had my first baby 3 days ago and now im hit by this
Congratulations! But that doesn't change the situation.
Have some mercy my freind, what ever you get wi
i'm paying this amount myself. I will get sued and they will take my to court
The amount you offer is ridiculous and even offensive. Do you think your data is worth $500?
Sir i'm no body here, i'm just a IT guy working from home. Please have some mercy and tell me how much would make you happy? I can borrow some money and pay like $800
No
1000 and i will be eating water for the rest of the week
No!
100k!
I need like 10 years to be able to save that much
Solve this issue within the company!
// Analysis
Analyst Observations
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.