// Ransomware Negotiation Transcript
lockbit3.0 Ransomware Negotiation — Wabtec Corporation
// Context
About This Negotiation
This transcript documents a lockbit3.0 ransomware negotiation with Wabtec Corporation. The negotiation consisted of 39 messages exchanged over 29 days, beginning on 2022-06-29.
The initial ransom demand was $25.0M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
[Chat started]
Hello we are writing you as you ask in your note. How do we get our files back?
Hello. Please tell us your company name and confirm you are an official representative of the company.
We are Wabtech, I am IT mgr with firm. Thank you.
You must pay us to get your files back.
How much are you asking for?
$25 million for universal decryptor and destruction of stolen files.
Hello, we moved to here as you asked.
You mentioned you took out data, we need to understand that better. Please show us what you have taken so I can take this to the bosses. Thank you.
[REDACTED URL]
password = 5446731864718376751313472162
Thank you for this. I will send this to our bosses for review.
Our team and bosses are reviewing your large list. How much data is that? Also, would you kindly let us pick some files our of your list to ask for so we know you do indded have our data? Thank you.
About 2 TB. Yes.
Hello, can we please receive these files back from you?
F:\wabtec\files\WCSSRV0453_Commercial_Functions\Commercial Functions\Marketing\Marketing Effectiveness\Training Conferences\What a Declining Business Media Means to CEOs.pdf F:\wabtec\files\CommercialKnowledgePortal\Commercial Knowledge Portal\Competitor Intelligence\CI at Tradeshows\2010 InnoTrans\InnoTrans 2010 Photos\Voith\Gravita Switcher\DSC01672.jpg F:\wabtec\files\CRDSRV0008_Documentation_and_Manuals\Documentation and Manuals\Vishay Strain Gauge Manuals\Vishay Micro Measurements\Vishay M-Line Accessories.pdf F:\wabtec\files\wcssrv036_RCV_Public_Drive\RCV_Public_Drive\SAFETY\Carson\Incident -Injury Forms\WGS SAFETY ALERT NOTICE TEMPLATE.docx F:\wabtec\files\LPZSRV0014_Technologie\Technologie\ToPs_Daten\Dokumente\LASER\DATEN\5185766_1.pdf F:\wabtec\files\VCISRV0028_Project_Engineering\Project Engineering\Engineering Administration\Policies, Procedures and Guidelines\Travel Policy\Wabtec Travel and Entertainment Policy - Final_2019-11-01.pdf F:\wabtec\files\WCTSRV0018\g\PLM\WTDSRV0014\projects\DenverP3_CP\1-56468_SLDPRT\D\whereused.pdmw F:\wabtec\files\WCMSRV0006_Pre-stagedData\Pre-stagedData\Completed Projects\QJHO01001-JohnHolland-Certification of Points\E - Engineering\E2 - Deliverables\CMC - Turnout Certification\Checksheets\03.05.2018 F:\wabtec\files\Departments_hr\HR\BENEFITS\WELLNESS 2016\Wabtec Online Store Flyer.docx F:\wabtec\Manufacturing\CAR projects\Wabtec QIP Assessment Info Request.xlsx F:\wabtec\files\WTDSRV0030_Materials\Materials\Packing Slips OSWH\2022\May 2022\5-23-22.pdf F:\wabtec\files\Finance1\turbo_LP\fixed assets\TNX\Tooling\50311 Balancing tool.pdf F:\wabtec\files\BSLSRV0001_Customer_Files\Customer Files\1. Customer Information\Siemens Mobility\2021\Purchase Orders\PO 4509763478, SO-0014037, 49364-14, 2021-12-14\Buy America Certificate_Rev.1 (PO 4509763478) - Signed Dec. 22, 2021.pdf F:\wabtec\files\WBJSRV0002_Accounting\Accounting\ABNER\ateixeira\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SH5IQIL6\597D3FCACB12FBFAC9CEBBAFF93D[1].jpg
14 total please.
[REDACTED URL]
password = 5446731864718376751313472162
Thank you for this. Sending to the bosses for review, be back in touch.
Hello, can you please decrypt these files so we know your key works per your message on this site?
File: [registry.xml.lockbit]
File: [registry.7z]
Thank you. So if we were considering payment, would we get 1. Working decryptor tool 2. Our data back or deleted 3. Guarantee to not publish it or leak it on dark web 4. Tell us how you got into our network? Please let us know.
1 yes 2 yes 3 yes 4 no
Ok, letting bosses know the above. We are still reviewing the data dump due to size, and will be talking to the bank to see how much funds we would be avle to come up with. Be back in touch.
Hello, is this all of the data you have taken from us, in your file listing? Can you please let us know. Thank you.
Yes
Ok, that is good for us to know. We will be trying to come up with as many funds as we can and are circling up with the bank when they open after the weekend. How do we get BTC? Thanks.
You can use crypto exchanges to get btc.
So? Weekend ended long time ago. Are you ready to pay?
Hello we are engaged with the bank, the logistics are going to take a little bit of time. This is not something we are used to deal with. We need some more time please.
You must hurry up. We're not going to wait you forever. We'll have to raise the price by friday if we won't receive full payment by tomorrow evening.
Hello our bosses and executive team are in contact with the bank about logistics and how much we can get, this is not something they normally do so the logistics are hard and take some time. We cannot make this happen by Friday, we are asking for more time, next week please. We are talking to you in good faith and thank you for your help so far.
You already have spent 3 weeks. It's more than enough to check your balance and obtain cryptocurrency. The price will be raised to 30M from tomorrow.
Hello. Another week passed. Should we wait for payment or we may proceed to the publication of your files?
Are you there?
???
wtf?
// Analysis
Analyst Observations
- The initial demand of $25.0M places this in the upper tier of ransomware demands, typically reserved for large enterprises.
- LockBit 3.0 was the most prolific ransomware group of 2022-2023, responsible for more attacks than any other group. Their infrastructure was taken down by Operation Cronos in February 2024.
- → LockBit 3.0 threat actor profile — TTPs, ransom demands, and active campaigns.