{ "chat_id": "Chat: *************888989", "messages": [ { "party": "Victim", "content": "[Chat started]", "timestamp": "30.08.2022 03:48:17 UTC" }, { "party": "Victim", "content": "Hello. We received your note. Can you please tell us your demand and send us the file tree of data taken. Thank you.", "timestamp": "30.08.2022 03:57:19 UTC" }, { "party": "LockBit 3.0", "content": "Hello. Tell me please your name?", "timestamp": "30.08.2022 06:16:40 UTC" }, { "party": "LockBit 3.0", "content": "We provide a complete file tree only after payment of the redemption fee. Right now we can give you a partial list of no more than 10%", "timestamp": "30.08.2022 14:12:46 UTC" }, { "party": "Victim", "content": "I am the IT manager and the only one that can use TOR", "timestamp": "30.08.2022 14:27:53 UTC" }, { "party": "LockBit 3.0", "content": "$6,000,000 is the price.", "timestamp": "30.08.2022 14:42:36 UTC" }, { "party": "Victim", "content": "Where did you come up with this number. I think you have us confused with a different firm. ", "timestamp": "30.08.2022 16:56:44 UTC" }, { "party": "Victim", "content": "Our cash flow is under $200K and you are asking 30 times that. We are willing to settle with you but you have us confused with another company. We are willing to pay $50K ", "timestamp": "30.08.2022 20:34:09 UTC" }, { "party": "Victim", "content": "Do we have a deal at $50K? Please send us your wallet address. Thank you.", "timestamp": "31.08.2022 16:12:23 UTC" }, { "party": "LockBit 3.0", "content": "You can better.", "timestamp": "01.09.2022 16:57:58 UTC" }, { "party": "Victim", "content": "What are you asking for then? ", "timestamp": "01.09.2022 19:05:36 UTC" }, { "party": "Victim", "content": "we would like to conclude our business with you as soon as possible", "timestamp": "01.09.2022 19:06:48 UTC" }, { "party": "LockBit 3.0", "content": "I can give you decryptor in 1 click", "timestamp": "01.09.2022 20:12:10 UTC" }, { "party": "LockBit 3.0", "content": "Simple sent to my wallet $6m usd", "timestamp": "01.09.2022 20:12:29 UTC" }, { "party": "Victim", "content": "You must have us confused with someone else. You are asking 30 times more than our cash flow. We need a far better number. ", "timestamp": "01.09.2022 20:52:49 UTC" }, { "party": "LockBit 3.0", "content": "You are bluffing", "timestamp": "01.09.2022 21:14:39 UTC" }, { "party": "LockBit 3.0", "content": "Your financial documents that were stolen by us tell us that you have a lot more money than you claim, I think the IRS would love to see your documents.", "timestamp": "01.09.2022 21:17:00 UTC" }, { "party": "LockBit 3.0", "content": "It will be better for you if you just pay and we leave our attack in secret.", "timestamp": "01.09.2022 21:17:45 UTC" }, { "party": "Victim", "content": "Send us the financial documents you are referring to as you are mistaken.", "timestamp": "01.09.2022 21:25:50 UTC" }, { "party": "Victim", "content": "We also received your message on our customer support page today. We told you we want to solve this quickly. You have mispriced us as we are a small financial organization. ZoomInfo shows you our size but that number on revenue is high as well. ", "timestamp": "01.09.2022 21:28:33 UTC" }, { "party": "LockBit 3.0", "content": "You can see all the documents in our brilliant blog, you can also see how greedy people can be and how much money they lose by refusing to pay a relatively small amount of their income", "timestamp": "01.09.2022 21:29:07 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/dpGGTXwJUYMy8cTW63002f8b14b9c", "timestamp": "01.09.2022 21:32:46 UTC" }, { "party": "LockBit 3.0", "content": "Example", "timestamp": "01.09.2022 21:32:54 UTC" }, { "party": "Victim", "content": "As we have said already - we are a small financial firm and your demand does not match our business or what we can pay. Give us a realistic amount and we can settle this quickly.", "timestamp": "01.09.2022 21:39:50 UTC" }, { "party": "LockBit 3.0", "content": "Give us a realistic amount and we can settle this quickly.", "timestamp": "01.09.2022 21:53:51 UTC" }, { "party": "Victim", "content": "the onion link is not work for us", "timestamp": "01.09.2022 21:54:37 UTC" }, { "party": "LockBit 3.0", "content": "try mirrors", "timestamp": "01.09.2022 21:54:53 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion/", "timestamp": "01.09.2022 21:54:55 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion/", "timestamp": "01.09.2022 21:55:01 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion/", "timestamp": "01.09.2022 21:55:07 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion/", "timestamp": "01.09.2022 21:55:15 UTC" }, { "party": "Victim", "content": "You asked for a realistic amount. We gave you an amount. If you looked at zoominfo, you would realize we are mispriced. We are ready to transfer you $50K", "timestamp": "01.09.2022 21:56:44 UTC" }, { "party": "Victim", "content": "We are ready to solve this now. ", "timestamp": "01.09.2022 22:03:41 UTC" }, { "party": "LockBit 3.0", "content": "It's not enough.", "timestamp": "01.09.2022 22:04:49 UTC" }, { "party": "Victim", "content": "give me a number to work with then. ", "timestamp": "01.09.2022 22:05:25 UTC" }, { "party": "LockBit 3.0", "content": "$6m", "timestamp": "01.09.2022 22:05:37 UTC" }, { "party": "Victim", "content": "Do you understand me, obviously not. You are asking for 30 times Net Income. Our total revenue is below $10KK. Look at zoominfo. ", "timestamp": "01.09.2022 22:06:32 UTC" }, { "party": "Victim", "content": "You have us confused with some other firm", "timestamp": "01.09.2022 22:06:53 UTC" }, { "party": "Victim", "content": "As I have told you, we are willing to settle as quickly as possible if you give us a realistic number", "timestamp": "01.09.2022 22:08:14 UTC" }, { "party": "LockBit 3.0", "content": "tapcocu.org?", "timestamp": "01.09.2022 22:08:22 UTC" }, { "party": "Victim", "content": "Yes. ", "timestamp": "01.09.2022 22:09:47 UTC" }, { "party": "LockBit 3.0", "content": "$6m", "timestamp": "01.09.2022 22:17:29 UTC" }, { "party": "LockBit 3.0", "content": "Total revenues $19,621,065 2019 Yearly growth 2.9% % of revenues n/a 20152016201720182019$13m$17m Total expenses $15,846,289 2019 Yearly growth 2.4% % of expenses n/a 20152016201720182019$11m$13m$15m Total assets $394,852,832 2019 Yearly growth 5.5% % of assets n/a 20152016201720182019$0.3b$0.4b$0.4b Num. employees 110 2019 Yearly growth 6.8%", "timestamp": "01.09.2022 22:19:48 UTC" }, { "party": "LockBit 3.0", "content": "We started a DDoS attack on your site.", "timestamp": "01.09.2022 23:14:07 UTC" }, { "party": "LockBit 3.0", "content": "As of now it is not possible to authorize on your site.", "timestamp": "01.09.2022 23:36:21 UTC" }, { "party": "Victim", "content": "Are you not understanding financials. Let me help you out", "timestamp": "01.09.2022 23:36:47 UTC" }, { "party": "Victim", "content": "You have 2019 numbers, not 2022. Also Revenues- Expenses with the numbers you have listed, which are not correct are only equate to under $1M. Are you telling me you normally ask a company to pay $6M on under $10M in revenue with Net Income a little over $200K. I have no idea how any company would pay you. ", "timestamp": "01.09.2022 23:38:45 UTC" }, { "party": "LockBit 3.0", "content": "Are you saying that the net profit per year is $200,000?", "timestamp": "01.09.2022 23:39:47 UTC" }, { "party": "Victim", "content": "After you take out all the EBITDA and expenses, yes. Look. we want to work with you but what you ask is impossible to give. Give me a workable number and we will come to terms", "timestamp": "01.09.2022 23:41:47 UTC" }, { "party": "LockBit 3.0", "content": "I don't believe you make 200,000 a year, that's a lie.", "timestamp": "01.09.2022 23:42:30 UTC" }, { "party": "Victim", "content": "why does you site say socket connection issue", "timestamp": "01.09.2022 23:45:24 UTC" }, { "party": "LockBit 3.0", "content": "its normal", "timestamp": "01.09.2022 23:45:32 UTC" }, { "party": "LockBit 3.0", "content": "we in tor and under ddos 24\\7\\365", "timestamp": "01.09.2022 23:45:46 UTC" }, { "party": "Victim", "content": "you are under DDOS by who", "timestamp": "01.09.2022 23:46:05 UTC" }, { "party": "Victim", "content": "ok. know I understand why socket connection issue. ", "timestamp": "01.09.2022 23:46:31 UTC" }, { "party": "LockBit 3.0", "content": "we attack hundreds of companies like you, there are many who don't like us)", "timestamp": "01.09.2022 23:46:34 UTC" }, { "party": "Victim", "content": "i understand. well, we are not attacking you. We just want to get to a solution and move about business", "timestamp": "01.09.2022 23:47:15 UTC" }, { "party": "LockBit 3.0", "content": "Ok no problem, transfer me 6 million and we'll make a deal right now, everyone will be happy.", "timestamp": "01.09.2022 23:47:53 UTC" }, { "party": "Victim", "content": "I am really trying to explain it. We do not have what you want. You are asking for 60% of revenue. You really extort companies for 60% of revenue. So you would charge a company that has $200Million of revenue $120Million ransom. ", "timestamp": "01.09.2022 23:49:39 UTC" }, { "party": "LockBit 3.0", "content": "Total assets $394,852,832", "timestamp": "01.09.2022 23:50:34 UTC" }, { "party": "Victim", "content": "You are working with bad information on us. so either reprice us and come to something reasonable or we are not going to have much to chat about", "timestamp": "01.09.2022 23:50:36 UTC" }, { "party": "Victim", "content": "That is not our money. I am sure you have a bank account somewhere. The bank cannot give your money to someone else", "timestamp": "01.09.2022 23:51:47 UTC" }, { "party": "LockBit 3.0", "content": "What kind of reasonable price can we talk about if you lie to me in every word?", "timestamp": "01.09.2022 23:52:03 UTC" }, { "party": "Victim", "content": "Why would lie to you. I just want to get to a solution and then move to fixing our network. ", "timestamp": "01.09.2022 23:53:14 UTC" }, { "party": "LockBit 3.0", "content": "Since you are a credit organization because of our attack all your clients will stop trusting you, your business will be destroyed, this is what our pricing policy is related to, each company has an individual approach, you can never agree with me for 50 thousand dollars, if you have no more money do not write me anymore.", "timestamp": "01.09.2022 23:53:22 UTC" }, { "party": "Victim", "content": "If you give me something to work with, I can see what I can do here", "timestamp": "01.09.2022 23:57:26 UTC" }, { "party": "LockBit 3.0", "content": "Ask something of the director of your credit organization, whether he wants to preserve the reputation of his company or whether he better start thinking about creating a new company.", "timestamp": "01.09.2022 23:59:03 UTC" }, { "party": "LockBit 3.0", "content": "Thanks for the dialogue, I have 3 prostitutes coming to see me, I have to leave you. Have a good day.", "timestamp": "02.09.2022 00:00:37 UTC" }, { "party": "Victim", "content": "Well, enjoy then. When you return, can we get to a solution. ", "timestamp": "02.09.2022 00:01:53 UTC" }, { "party": "Victim", "content": "We want to get to a deal as quickly as possible. After discussions with the board and reviewing our financials, we are looking to increase our offer to be between $250K to $400K. We want to settle today so hopefully you can understand our position and we can close this deal. For the amount within the range, we would like the decryption software, support for it, you said you had data of ours so we would like a listing of the documents and some type of deletion log to prove you no longer have it, explain how you got into our network, and to never attack us again. We look forward to your positive response. ", "timestamp": "02.09.2022 12:03:08 UTC" }, { "party": "LockBit 3.0", "content": "This is still not a sufficient amount, you are being brazen and clearly misleading me, but I take into account your step to meet and am also ready to give you a discount of up to $ 5.500.000.", "timestamp": "02.09.2022 13:09:38 UTC" }, { "party": "Victim", "content": "Not trying to be brazen nor misleading you. I am trying to provide the facts to you that your demand amount is not realistic for a company our size and if you would work with us, we would settle this todayh ", "timestamp": "02.09.2022 13:12:16 UTC" }, { "party": "LockBit 3.0", "content": "If you had stopped lying to me and wanted to save your business then you would have stopped the ddos attack and decrypted your network in 5 minutes.", "timestamp": "02.09.2022 13:15:10 UTC" }, { "party": "Victim", "content": "I want to decrypt our network as quickly as possible and want to do a deal. Your starting number is not manageable for a company of 100 employees. If your number would have been in the $250K to $400K range, we would have paid you right away. ", "timestamp": "02.09.2022 13:19:04 UTC" }, { "party": "Victim", "content": "so let's talk about paying you right away. Can we get a reasonable number so you can go enjoy your weekend", "timestamp": "02.09.2022 13:19:44 UTC" }, { "party": "LockBit 3.0", "content": "In connection with a ddos attack you try to change the source code of your website and the entire authorization page including post data, this will not help you, you open new vulnerabilities that will allow other hackers to easily download all the data from your website, thus you only make yourself worse, once your customers' data is published you can forget about your business, no one will ever trust you. Stop, don't make a stupid step, your assets are more than 300 million dollars, your director will not get poorer if he pays me 5.500.000. Do not be greedy, save your priceless reputation and business, in banking there is nothing more valuable than a reputation, your reputation you have earned over many years and lose in an instant.", "timestamp": "02.09.2022 13:19:50 UTC" }, { "party": "Victim", "content": "can you proivde the partial file tree while I caucus with my board members", "timestamp": "02.09.2022 13:35:52 UTC" }, { "party": "LockBit 3.0", "content": "It will take some time, yes I can do it if you are willing to wait.", "timestamp": "02.09.2022 13:49:44 UTC" }, { "party": "Victim", "content": "As a credit union, we are a not for profit and the number your reference in not our money. We hold money for indivuduals in their accounts in their name. We cannot use this money. ", "timestamp": "02.09.2022 16:24:09 UTC" }, { "party": "LockBit 3.0", "content": "Then let this organization know that it's time to take your money, your time is up.", "timestamp": "02.09.2022 17:52:23 UTC" }, { "party": "LockBit 3.0", "content": "The best I can do for you is 5 million", "timestamp": "02.09.2022 17:54:52 UTC" }, { "party": "LockBit 3.0", "content": "Voice your decision, it's time to publish your data.", "timestamp": "02.09.2022 17:55:33 UTC" }, { "party": "Victim", "content": "I don't know what you mean by our time is up but we are negotiating in good faith. Our board is willing increase it's offer range to $650K - $750K which we can pay quickly. Publishing our data does no good. We are here trying to resolve this. You think we have more money than we have and we have asked you to consider we are a not for profit credit union and the assets you reference are not ours.", "timestamp": "02.09.2022 18:04:55 UTC" }, { "party": "LockBit 3.0", "content": "Tell your board that the price will not go below 5 million, please give me their answer as soon as possible.", "timestamp": "02.09.2022 18:06:22 UTC" }, { "party": "LockBit 3.0", "content": "I also negotiate in good faith, but I can't do it forever; my time is very expensive. When I see that negotiations are deadlocked and you do not hear me, there is no point in continuing negotiations. We are not in the Arab market to bargain here for 100-200 thousand dollars. You and I have serious businesses, we earn millions of dollars, the reputation of your business is priceless and can not be worth less than 5 million, if your leadership is adequate and understands that the business had to close, they will pay 5 million, if you are willing to close your business, enjoy your 5 million and do not pay me.", "timestamp": "02.09.2022 18:08:50 UTC" }, { "party": "Victim", "content": "We are under 100 person firm. The assets you reference are not ours. If you are financially motivated we have given you a reasonable offer and most victims on your blog have amounts fall smaller than the amount you want and are larger organizations.", "timestamp": "02.09.2022 18:26:31 UTC" }, { "party": "LockBit 3.0", "content": "The amount of ransom is always individual and depends on different factors, annual income, profit, quality of network encryption, quantity of stolen data, quality of stolen data, availability of dirt, violations of the law and more. In my blog there is no credit organization that gives loans to people, what do you think is the reason for this?", "timestamp": "02.09.2022 18:28:43 UTC" }, { "party": "LockBit 3.0", "content": "I'm going for a boat ride soon, if you want to close the deal right now let me know back soon. Thank you.", "timestamp": "02.09.2022 18:56:32 UTC" }, { "party": "Victim", "content": "We want a deal as well but remind you we only hold money and it's not ours to use under any circumstance by law. The money that is ours cannot be used for non-banking expenses by law and what is left over after that is very little. We simply don't have the amount of money you demand but have offerred you a tremendous amount of money. Take this deal and let's end this.", "timestamp": "02.09.2022 18:59:49 UTC" }, { "party": "LockBit 3.0", "content": "I cannot accept your amount. I'm sorry.", "timestamp": "02.09.2022 19:45:16 UTC" }, { "party": "Victim", "content": "We are here when you want to do a deal. We have funds to pay just not in the range you are asking for. ", "timestamp": "02.09.2022 20:15:33 UTC" }, { "party": "Victim", "content": "Hopefully then boat trip was relaxing on your end. We are ready to close the deal at 750k as we were successful in securing funds. Let's close the deal and both of us can enjoy the rest of the weekend. Thank you.", "timestamp": "03.09.2022 13:32:05 UTC" }, { "party": "LockBit 3.0", "content": "The best I can do for you is 5 million", "timestamp": "03.09.2022 14:33:42 UTC" }, { "party": "Victim", "content": "You said you were going to send us the files tree. Can you please send the partial tree. Thank you.", "timestamp": "03.09.2022 16:33:41 UTC" }, { "party": "LockBit 3.0", "content": "Yes I can", "timestamp": "03.09.2022 17:15:30 UTC" }, { "party": "LockBit 3.0", "content": "File: [1.7z]", "timestamp": "03.09.2022 20:16:25 UTC" }, { "party": "LockBit 3.0", "content": "File: [2.7z]", "timestamp": "03.09.2022 20:17:09 UTC" }, { "party": "LockBit 3.0", "content": "File: [3.7z]", "timestamp": "03.09.2022 20:18:21 UTC" }, { "party": "LockBit 3.0", "content": "File: [4.7z]", "timestamp": "03.09.2022 20:18:35 UTC" }, { "party": "LockBit 3.0", "content": "File: [9.png]", "timestamp": "03.09.2022 20:18:52 UTC" }, { "party": "LockBit 3.0", "content": "Since all your files do not have names but are simply numbered for better security and handling and use of special programs, I made screenshots of some random files for you.", "timestamp": "03.09.2022 20:19:55 UTC" }, { "party": "LockBit 3.0", "content": "Because of this policy of naming files it is hard to find the most valuable and compromising files of your company, but I was able to find a file that describes your money and the money of your investors, this amount exceeds 500 million dollars, so this once again confirms that you are evading taxes and 1% of this amount for me and keeping our secrets will be a perfectly fair amount.", "timestamp": "03.09.2022 20:21:26 UTC" }, { "party": "Victim", "content": "Our NET Revenue last year was $3 million. The document you provided has our clients\u2019 money and we only hold the funds. We cannot access the funds as only our clients can. So, when we pay you in BTC it goes into a wallet. Your wallet is likely held at some brokerage firm. The brokerage firm cannot access your wallet and take that money. They are just holding the money and you are the one that controls it not us. When we report to our regulator, we must report the amount of funds we are holding. Again \u2013 this is loans and deposits that we cannot use and is reported to regulators. We are offering you 25% of our Net Revenue Number of $3million. $750,000 is a sizeable sum. We want to get to a deal and will pay you quickly. So, hopefully you understand that we do not control the $500,000,000 number as it controlled by our members. We only can control the $3 Million Net Revenue Number and we are offering 25% of that sum. I do not know if other organizations are giving you this amount of their Net Revenue. We are a not-for-profit credit union. Please understand that we want to settle and will pay you with funds we can control. Can we conclude our affairs and move forward and pay you what we control.", "timestamp": "04.09.2022 17:16:39 UTC" }, { "party": "LockBit 3.0", "content": "Hi, you're trying to trick me again, once again, the minimum possible ransom amount is $5 million. Judging by your documents you regularly violate tax laws and evade taxes, you understate your profits, although in fact it is much higher, you are engaged in money laundering, this is the first thing. Secondly as soon as all this becomes public, none of your investors will not trust you with money for your business, as well as the reputation as a credit institution will be forever and irrevocably ruined, your competitors will be very happy to download all the loan agreements and lure your clients to themselves, so please stop pissing in my ears, pay 5 million dollars and let's go as ships at sea in peace.", "timestamp": "04.09.2022 17:57:24 UTC" }, { "party": "Victim", "content": "No one is trying to trick you and we are not pissing in your ears. Your accusations are unfounded as we are audited by regulators every year. We have tried to explain our business model to you and you seem to not understand. We are a not for profit credit Union and our net revenue last year was $3M. Our records are public and you can look them up. We have told you we will give you 25 percent of our net revenue, which is 750K. We have been through your blog and companies with larger revenue than we have are charged less than you are asking from us. We are willing to sail in peace just modify your understanding of the situation and we will pay quickly.", "timestamp": "04.09.2022 21:49:54 UTC" }, { "party": "LockBit 3.0", "content": "$5,000,000 is the price.", "timestamp": "04.09.2022 22:56:10 UTC" }, { "party": "LockBit 3.0", "content": "http://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead.onion/post/IkGuYqjqKZ5KB0nV63153472ed56e", "timestamp": "04.09.2022 23:32:14 UTC" }, { "party": "LockBit 3.0", "content": "I am tired of your lies, you have 21 hours to pay, after the timer expires all your information will be published publicly.", "timestamp": "04.09.2022 23:33:04 UTC" }, { "party": "LockBit 3.0", "content": "Before you send $5 million to my wallet, send a $1 test payment please.", "timestamp": "04.09.2022 23:34:55 UTC" }, { "party": "LockBit 3.0", "content": "bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd bitcoin wallet", "timestamp": "04.09.2022 23:35:11 UTC" }, { "party": "LockBit 3.0", "content": "Good luck", "timestamp": "04.09.2022 23:35:23 UTC" }, { "party": "Victim", "content": "The below link is from an independent source which confirms our net income of $3,593M for the year, which you can see on page 7 of the report. This is the money we have available to settle our affairs not the $500M in customer loans and deposits you continue to reference which you can see on pg.13 of the report and which isn\u2019t hidden from the authorities as you claim. Please accept our offer and let's settle this once and for all. If you are financially motivated, then give us a realistic number as you are already receiving 25 percent of our net revenue. https://www.mossadams.com/getmedia/7b751331-6788-43df-b8e2-bcf754e9d85e/Credit-Union-Index-WA-OR.pdf", "timestamp": "05.09.2022 03:09:27 UTC" }, { "party": "LockBit 3.0", "content": "5 million is a realistic figure for you and it is not up for discussion. Pay up or you will lose your business.", "timestamp": "05.09.2022 09:21:19 UTC" }, { "party": "Victim", "content": "In good faith, paying you $1,000 to extend the leak clock does nobody any good. We cannot pay $5M and we have tried to explain this to you multiple times. Our net income is $3M. It seems like we have hit an impasse in our discussions. We do not understand how you can in good faith ask a company to pay more in net income than they made. It seems you want our business to go under. From a business perspective, we all win if you would lower your number and we sail our separate ways. If I could raise the amount to $1M, will this be enough to satisfy your demands. If so, I can talk further with the board about how to raise the additional amount.", "timestamp": "05.09.2022 15:58:18 UTC" }, { "party": "LockBit 3.0", "content": "Talk to the board about 1 percent of your $500 million, you have three hours left.", "timestamp": "05.09.2022 17:23:27 UTC" }, { "party": "Victim", "content": "The board has communicated that we only made $3Million in Net Revenue last year and provided you third party references on it. We do not control the $500 million that you continue to reference as that is our client money. Publishing us does no good on either party as we are both motivated to get to a solution. What other information can we provide you to demonstrate that we do not control the $500 million and only control the $3M. We are only a 100 person company.", "timestamp": "05.09.2022 17:44:20 UTC" }, { "party": "LockBit 3.0", "content": "I don't believe you.", "timestamp": "05.09.2022 17:45:28 UTC" }, { "party": "LockBit 3.0", "content": "bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd bitcoin wallet to extend the timer by 1 day", "timestamp": "05.09.2022 17:45:55 UTC" }, { "party": "LockBit 3.0", "content": "Send me $1,000.", "timestamp": "05.09.2022 17:46:17 UTC" }, { "party": "Victim", "content": "Look at the public record documents we sent to you in the last few messages. It lays it all out in financial details. I do not know what else we can provide you. that has all credit unions listed and anyone can access it.", "timestamp": "05.09.2022 17:51:44 UTC" }, { "party": "LockBit 3.0", "content": "Public information is fake, the real information is contained in your documents, I have thousands of your documents, all documents do not have file names, if you tell me the document number in which your real reporting is contained it will be easier for us to check the information and compare it with public fake reports.", "timestamp": "05.09.2022 17:53:56 UTC" }, { "party": "LockBit 3.0", "content": "File: [bluff1.png]", "timestamp": "05.09.2022 18:19:39 UTC" }, { "party": "LockBit 3.0", "content": "You're a filthy liar, your net profit per month is $3-4 million dollars, that's just the information I could find now in one of your documents", "timestamp": "05.09.2022 18:20:26 UTC" }, { "party": "LockBit 3.0", "content": "File: [bluff2.png]", "timestamp": "05.09.2022 18:27:50 UTC" }, { "party": "LockBit 3.0", "content": "non-interest income another 5 million a month", "timestamp": "05.09.2022 18:28:12 UTC" }, { "party": "LockBit 3.0", "content": "The price for you will not be lower than $5 million. This conversation with you is over.", "timestamp": "05.09.2022 18:28:56 UTC" }, { "party": "LockBit 3.0", "content": "I hope the IRS will properly deal with your company after leaking these documents.", "timestamp": "05.09.2022 18:29:28 UTC" }, { "party": "LockBit 3.0", "content": "And put in jail your management who reports three million a year", "timestamp": "05.09.2022 18:29:51 UTC" }, { "party": "LockBit 3.0", "content": "Goodbye.", "timestamp": "05.09.2022 18:30:01 UTC" }, { "party": "Victim", "content": "We just want to understand your position in that you will walk away from a million dollars which is 33 percent of our Net Revenue for payment of a decryption key. ", "timestamp": "05.09.2022 19:11:50 UTC" }, { "party": "LockBit 3.0", "content": "Why are you pretending to be an idiot? I gave you the documents that prove that your company has a hidden untaxed net profit of 4-5 million a month!", "timestamp": "05.09.2022 19:32:06 UTC" }, { "party": "Victim", "content": "\u2022\tYou continue to misinterpret our records, and this has drawn out our negotiations many days. We have nothing to hide in our financial records as they are public and regulators, third party auditors, investors, and others can view them at any time. The link we provided shows this. Now, Bluff 1 shows our cumulative net income for the year at $3.5M as of August 2022 (Cumulative means from January to Today), the prior month\u2019s income rolls forward and we actually lost money in August. Bluff 2 shows the cumulative year-to-date income as of August which is included in our $3.5M earnings to date and not a separate income number as you incorrectly assessed. All our Financials can be found in the Accounting Drive, Board Reports folder by year and month. The balance sheet and income statement in the folder provides the financial picture. While you review these documents, please delay posting our information to your blog which will harm our negotiations. After you have read the documents, can we conclude our business. We just want to understand your position in that you will walk away from a million dollars which is 33 percent of our Net Revenue for payment of a decryption key.", "timestamp": "05.09.2022 20:21:14 UTC" }, { "party": "LockBit 3.0", "content": "Okay, my boss agrees to $4 million.", "timestamp": "05.09.2022 20:22:23 UTC" }, { "party": "Victim", "content": "Now that you understand our financials. Can we settle and we will send you 1 million.", "timestamp": "06.09.2022 13:32:12 UTC" }, { "party": "LockBit 3.0", "content": "Ok my boss agrees to 1 million, only if you send it today, here is the bitcoin wallet, bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd", "timestamp": "06.09.2022 15:42:00 UTC" }, { "party": "Victim", "content": "In exchange for $1M we will receive all decryption keys, support, proof of data deletion, and a detailed explanation on how to broke into our system.", "timestamp": "06.09.2022 16:36:12 UTC" }, { "party": "Victim", "content": "Also, how long after payment will we receive the decryptor?", "timestamp": "06.09.2022 16:36:33 UTC" }, { "party": "LockBit 3.0", "content": "1 million just for the decryption keys. All other items are paid separately and will cost 3 million.", "timestamp": "06.09.2022 18:47:30 UTC" }, { "party": "Victim", "content": "Ok, so you are saying we pay $1million for the keys and support. And if we want the data back, that is another $1Million and the security report is $1M. ", "timestamp": "06.09.2022 18:49:54 UTC" }, { "party": "LockBit 3.0", "content": "Yes. You will receive a decryptor in 1 confirmation on the bitcoin network.", "timestamp": "06.09.2022 18:50:19 UTC" }, { "party": "Victim", "content": "I appreciate that you have given us options here. Need some time to discuss with the board and we have different time zones on what the meaning of send it today. ", "timestamp": "06.09.2022 18:53:39 UTC" }, { "party": "LockBit 3.0", "content": "I live in New York City. My time is now 2:55 p.m., you have until 12 a.m. to make the transfer if you want to take advantage of the discount.", "timestamp": "06.09.2022 18:55:55 UTC" }, { "party": "Victim", "content": "you realize we are on PDT not EDT. ", "timestamp": "06.09.2022 18:56:30 UTC" }, { "party": "LockBit 3.0", "content": "It would be easier if I told you that you have 10 hours to transfer the money.", "timestamp": "06.09.2022 18:57:39 UTC" }, { "party": "Victim", "content": "When we structured this deal, it was supposed to be a package deal. On the data, can you provide us a file tree", "timestamp": "06.09.2022 19:36:14 UTC" }, { "party": "Victim", "content": "If we are going to pay you this evening, can you stay online with questions that we have", "timestamp": "06.09.2022 19:46:59 UTC" }, { "party": "Victim", "content": "We want to meet your deadline but need a few answers from you. Thank you.", "timestamp": "06.09.2022 21:00:13 UTC" }, { "party": "Victim", "content": "Are you there. We are working on acquiring the funds you want for the decryptor. Can you answer a few questions", "timestamp": "06.09.2022 21:36:15 UTC" }, { "party": "LockBit 3.0", "content": "1 million dollars just a decryptor.", "timestamp": "06.09.2022 22:38:59 UTC" }, { "party": "LockBit 3.0", "content": "All other requests for an additional fee.", "timestamp": "06.09.2022 22:39:21 UTC" }, { "party": "LockBit 3.0", "content": "Getting a tree of downloaded files from your network, deleting those files, not allowing those files to be published on our blog separately $1 million.", "timestamp": "06.09.2022 22:40:25 UTC" }, { "party": "LockBit 3.0", "content": "Information about how we entered your network, as well as other vulnerabilities separately 1 million dollars.", "timestamp": "06.09.2022 22:41:38 UTC" }, { "party": "LockBit 3.0", "content": "What else do you want?", "timestamp": "06.09.2022 22:41:56 UTC" }, { "party": "LockBit 3.0", "content": "You don't have much time left, should I wait for your money today or not?", "timestamp": "06.09.2022 23:15:49 UTC" }, { "party": "Victim", "content": "Yes. You should wait. We receive the decryptor along with support. Wallet is confirmed as bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd ", "timestamp": "06.09.2022 23:53:47 UTC" }, { "party": "Victim", "content": "We are ready to go once you confirm the wallet ", "timestamp": "06.09.2022 23:55:54 UTC" }, { "party": "Victim", "content": "We have four hours left per your instructions. ", "timestamp": "06.09.2022 23:59:12 UTC" }, { "party": "LockBit 3.0", "content": "I confirm wallet.", "timestamp": "07.09.2022 00:25:54 UTC" }, { "party": "Victim", "content": "Thank you. Stand by. ", "timestamp": "07.09.2022 00:27:01 UTC" }, { "party": "Victim", "content": "We receive the decryptor after payment along with any support. Correct", "timestamp": "07.09.2022 00:45:53 UTC" }, { "party": "LockBit 3.0", "content": "Yes. Correct.", "timestamp": "07.09.2022 00:50:41 UTC" }, { "party": "Victim", "content": "We have sent payment ", "timestamp": "07.09.2022 01:44:58 UTC" }, { "party": "Victim", "content": "we are at 2 confirmations now. ", "timestamp": "07.09.2022 01:57:02 UTC" }, { "party": "Victim", "content": "The tranactions has been confirmed. Please send the decryptor.", "timestamp": "07.09.2022 03:24:59 UTC" }, { "party": "LockBit 3.0", "content": "Did you have any difficulty deciphering it?", "timestamp": "07.09.2022 13:47:50 UTC" }, { "party": "Victim", "content": "The Decryptor is not working properly for files in some locations of the computer such as \"C:\\Program Files\", \"C:\\WIndows\" folder and more locations etc. can you give us a new decryptor which works on all the files on the system?", "timestamp": "07.09.2022 19:47:18 UTC" }, { "party": "LockBit 3.0", "content": "Run decryptor as Administrator", "timestamp": "07.09.2022 20:08:35 UTC" }, { "party": "Victim", "content": "We are running the tool as System Administrator and have an issue - The Decryptor is not working properly for files in some locations of the computer such as \"C:\\Program Files\", \"C:\\WIndows\" folder and more locations etc. can you give us a new decryptor which works on all the files on the system?", "timestamp": "07.09.2022 20:39:43 UTC" }, { "party": "LockBit 3.0", "content": "Show me screenshot, it's impossible.", "timestamp": "07.09.2022 20:42:49 UTC" }, { "party": "Victim", "content": "Stand by ", "timestamp": "07.09.2022 20:44:57 UTC" }, { "party": "Victim", "content": "File: [image (1).png]", "timestamp": "07.09.2022 21:32:31 UTC" }, { "party": "LockBit 3.0", "content": "strange folder name \"samples_from_mn-dc003\"", "timestamp": "07.09.2022 21:52:30 UTC" }, { "party": "LockBit 3.0", "content": "I think it is because the user does not have enough rights to change the system files in the system folders. There are two variants here, either try to run the decryptor with different permissions, e.g. from the system or another administrator, or copy the files to the desktop and decrypt them.", "timestamp": "07.09.2022 21:54:03 UTC" }, { "party": "LockBit 3.0", "content": "I also need to know the model of the operating system on which you are observing this problem, I will do lab work and try to reproduce the situation.", "timestamp": "07.09.2022 22:02:07 UTC" }, { "party": "LockBit 3.0", "content": "Also please give me the MD5 hash sum of your decryptor", "timestamp": "07.09.2022 22:10:26 UTC" }, { "party": "LockBit 3.0", "content": "Maybe the decryptor got corrupted during the download.", "timestamp": "07.09.2022 22:10:50 UTC" }, { "party": "Victim", "content": "We\u2019ve also tested copying encrypted files into multiple folders deep with all permissions changed to full access to all users,everyone,domain users, etc. The decryptor does not decrypt anything outside of the folder that it\u2019s located in.", "timestamp": "07.09.2022 23:21:50 UTC" }, { "party": "Victim", "content": "i will acquire the items you are asking for", "timestamp": "07.09.2022 23:22:11 UTC" }, { "party": "Victim", "content": "Windows 11 , MD5 hash of LBB_Decryptor.exe: 5cb062a9833428b118121b987099cc28", "timestamp": "07.09.2022 23:25:28 UTC" }, { "party": "Victim", "content": "can you fix the file path on the decryption so it will run everywhere or does it have a command line that we can point it to", "timestamp": "07.09.2022 23:29:55 UTC" }, { "party": "Victim", "content": "please let's know what else you need so we can work the problem and fix our network", "timestamp": "08.09.2022 02:33:53 UTC" }, { "party": "Victim", "content": "any update on this. ", "timestamp": "08.09.2022 14:14:56 UTC" }, { "party": "LockBit 3.0", "content": "Yes", "timestamp": "08.09.2022 14:18:29 UTC" }, { "party": "LockBit 3.0", "content": "Please make a video recording as you decrypt, hundreds of companies successfully decrypt their data and only you allegedly encountered difficulties, it seems to me that you are lying as you like to do it.", "timestamp": "08.09.2022 14:23:23 UTC" }, { "party": "Victim", "content": "File: [decrypt_tool_fail_log.txt]", "timestamp": "08.09.2022 19:58:19 UTC" }, { "party": "Victim", "content": "We would like to be one of your successful companies and never chat again if the decryptor worked as we thought it would. We have no reason to lie as we paid a significant sum for it. We will create the video. We did create a log file that shows when the decryptor run that the files do not decrypt. ", "timestamp": "08.09.2022 19:59:11 UTC" }, { "party": "LockBit 3.0", "content": "It is very interesting to see your video.", "timestamp": "09.09.2022 11:19:41 UTC" }, { "party": "LockBit 3.0", "content": "I am also very curious why in your created log file there is no file in the folders that you stated, and gave a screenshot, such as program files", "timestamp": "09.09.2022 12:24:22 UTC" }, { "party": "LockBit 3.0", "content": "It would be interesting to see in the videos how you create the log file and how you try to decrypt the many files in the program files folder and others.", "timestamp": "09.09.2022 12:24:58 UTC" }, { "party": "Victim", "content": "We are getting close to decrypting all files but have some issues with these last remaining ones. We can't post to the chat because the file is too large. Here is our link to the files for you to take a look at. Thank you. ", "timestamp": "10.09.2022 19:43:33 UTC" }, { "party": "Victim", "content": "https://file.io/dhxwMCmmN5by", "timestamp": "10.09.2022 19:43:49 UTC" }, { "party": "LockBit 3.0", "content": "You keep ignoring my questions, I'm waiting for a video of you getting the log file and trying to decrypt files that are in the system folders. Like the program files, for example", "timestamp": "11.09.2022 13:07:03 UTC" }, { "party": "Victim", "content": "Yes we will get you the video with the system files being ignored soon, meanwhile we were able to use the commandline version of the tool and --path command and point it to specific paths to fix the issue where the GUI was ignoring some paths. The sample file sent is a file where the decryption failed no matter the path the file is located at", "timestamp": "11.09.2022 15:51:29 UTC" }, { "party": "LockBit 3.0", "content": "I'll ask you to edit your video faster, I'm already getting tired of this circus.", "timestamp": "11.09.2022 21:09:29 UTC" }, { "party": "LockBit 3.0", "content": "While you are in the business of tampering with evidence I will ask you just one question, will you pay to have your information removed or can I already publish the stolen information and our correspondence?", "timestamp": "11.09.2022 21:15:25 UTC" }, { "party": "Victim", "content": "We are getting tired as well from the circus. We were able to make strides in decryption. however we hit a snag and wanted your help. We will get the video to you", "timestamp": "12.09.2022 19:03:29 UTC" }, { "party": "Victim", "content": "We would like to understand the data you have and you promised us a partial file tree. If you can send us the partial file tree, we will discuss the amount you want with this", "timestamp": "12.09.2022 19:05:11 UTC" }, { "party": "Victim", "content": "We appreciate you taking your time with us. ", "timestamp": "12.09.2022 19:05:47 UTC" }, { "party": "Victim", "content": "Link to video: https://file.io/HP89VY5PmjW5", "timestamp": "12.09.2022 19:26:02 UTC" }, { "party": "LockBit 3.0", "content": "Why are you copying encrypted files into the system folders and trying to decrypt them? You told me that you cannot decrypt files that were already in the system folders, not the ones you are copying there.", "timestamp": "12.09.2022 22:35:09 UTC" }, { "party": "LockBit 3.0", "content": "I sent you some files, from the file tree makes no sense, all files have only ordinal numbers and have no names.", "timestamp": "12.09.2022 22:35:56 UTC" }, { "party": "LockBit 3.0", "content": "Price is not negotiable, either you pay 1 million or not pay, make a decision today please.", "timestamp": "12.09.2022 22:46:41 UTC" }, { "party": "Victim", "content": "We told you we could not decrypt and were showing you the issue as the decryptor would not go down to a folder level. We finally figured it out however another issue come up with the file we sent you as it will not decrypt.", "timestamp": "12.09.2022 23:32:59 UTC" }, { "party": "LockBit 3.0", "content": "You're trying to trick me, I've known that for a long time, but I wondered what ridiculous evidence you'd provide.", "timestamp": "13.09.2022 02:43:35 UTC" }, { "party": "LockBit 3.0", "content": "$recycle.bin;config.msi;$windows.~bt;$windows.~ws;windows;appdata;application data;boot;google;mozilla;program files;program files (x86);programdata;system volume information;tor browser;windows.old;intel;msocache;perflogs;x64dbg;public;all users;default", "timestamp": "13.09.2022 03:01:50 UTC" }, { "party": "LockBit 3.0", "content": "WHITE FOLDERS", "timestamp": "13.09.2022 03:02:04 UTC" }, { "party": "LockBit 3.0", "content": "The encryption tool never encrypts the data contained in these folders.", "timestamp": "13.09.2022 03:02:27 UTC" }, { "party": "LockBit 3.0", "content": "You lied to me from the beginning and made up every flaw in the decoder.", "timestamp": "13.09.2022 03:02:55 UTC" }, { "party": "LockBit 3.0", "content": "So I'm not going to believe your nonsense about a non-functional decryptor. Any files you send me you changed in the hex editor to fuck with my head.", "timestamp": "13.09.2022 03:04:41 UTC" }, { "party": "LockBit 3.0", "content": "bc1qyuunv9pz6f4qpgd0c0wmenu9zhr6u57yjf4afd", "timestamp": "13.09.2022 03:05:08 UTC" }, { "party": "LockBit 3.0", "content": "You have one day to pay for the deletion of the data, you filthy liar.", "timestamp": "13.09.2022 03:05:28 UTC" }, { "party": "Victim", "content": "We are willing to pay if you can produce a file listing. So are you producing one or not?", "timestamp": "20.09.2022 20:53:56 UTC" }, { "party": "LockBit 3.0", "content": "Pay and I will give you a list of files as soon as you pay.", "timestamp": "21.09.2022 04:41:16 UTC" }, { "party": "Victim", "content": "we told you - show us the file tree", "timestamp": "21.09.2022 13:19:35 UTC" }, { "party": "LockBit 3.0", "content": "I told you, your files have no names, there are only numbers instead of file names, the file tree makes no sense. I can let you download all your files after paying $1 million.", "timestamp": "21.09.2022 16:36:05 UTC" } ] }