Ransomware.live Negotiation Chat: 20210316

          Okay, what comes next?
        

3/16/2021, 12:17:32 AM

          As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website.
The recovery price is $920000 (17 BTC). If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge.
If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published and you will be provided with security tips on how to avoid further breaches.
We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch.
The example data pack will be provided tomorrow, which will include part of the file list and some actual data you can review.
        

3/16/2021, 8:03:37 AM

          [redacted]-30percentlisting.txt [ 7.4MB ]
        

3/16/2021, 8:42:44 AM

          [redacted]-datapack-example.zip [ 32.4MB ]
        

3/16/2021, 8:44:34 AM

          Can you allow us a few days to read through these? We have our hands full with our servers down and trying to look over the documents
        

3/16/2021, 5:22:27 PM

          Yes, you have time till the end of the week. Bit if you would like to receive a 25% discount it will be valid for only two business days.
        

3/16/2021, 5:40:34 PM

          Ok i understand. I will get back to you as soon as possible
        

3/16/2021, 10:09:35 PM

          I will come to this chat tomorrow with a decision. The final management meeting is this afternoon
        

3/18/2021, 8:18:54 PM

          Ok, we will be waiting for your reply tomorrow.
        

3/18/2021, 8:23:16 PM

          Ok thank you for giving us time to work through our analysis. With the end of the quarter closing in, our balances allow us to offer $110,000 to you for the deal. Please please take this offer to your side and ask if it is possible to accept. We will wait for your reply
        

3/19/2021, 5:31:10 PM

          Unfortunately we cannot accept this offer according to our internal rules, but we've discuss with the team and a ready to make a step forward by going down to $600k
        

3/20/2021, 7:58:50 AM

          Ok, I will tell the team this, but it's the weekend so they won't be able to meet until Monday or Tuesday ok?
        

3/20/2021, 12:52:11 PM

          Ok, just update me by Tuesday.
        

3/20/2021, 1:12:26 PM

          Ok yes
        

3/20/2021, 1:24:04 PM

          We are still in talks to see how we could pull authority to go higher but they are moving very very slowly. We have been able to get them to grant authority for a better offer of $145,000. Please tell me if it possible to accept this amount for us.
        

3/23/2021, 3:58:28 PM

          That is totally impossible. We have discussed internally and the lowest we can get is $350k. I am not authorized to accept any lower payment.
        

3/24/2021, 9:37:54 AM

          I submitted this to my superiors. I know they want to finish this up as soon as possible, but $350k may still be out of reach. I will check in with you when I hear back.
        

3/24/2021, 9:24:14 PM

          I will get back to you tomorrow with an update. Expenditures over a certain amount have to be approved by executive leadership and we are trying to keep this under that amount so we dont have to go through their approval.
        

3/25/2021, 9:24:35 PM

          ok. we will wait
        

3/25/2021, 9:38:14 PM

          Ok. By relocating some of our budget funds, we are able to move our offer higher to $162,000. I know this is lower than you are authorized to accept, but please let me know if your group can make an exception.
        

3/26/2021, 3:51:30 PM

          As I have already told, try to allocate $350k 
I cannot move any forward unfortunately
        

3/26/2021, 4:17:55 PM

          We'll need to find another way, because we cannot risk getting this delayed in the leadership approval process. Otherwise it will take weeks. I will have to look into outside sources for donations.
        

3/26/2021, 5:36:18 PM

          Ok. Keep us updated.
        

3/27/2021, 7:00:01 AM

          Please if you have a smaller amount from $350k this will help speed up the process greatly. I know you can't accept $162k, but it's going to be an uphill battle for us to try to double that amount for you. Please let me know
        

3/27/2021, 12:26:41 PM

          Can you please let me know if there is anything you could do. It is going to be challenging battle for us to come up with double the amount from what we have available ($162,000). We want to be able to reach an agreement with you but our executive leadership team is not approving $350,000. Please let me know if you can come down anymore.
        

3/28/2021, 1:09:05 PM

          Let's meet in between at the sum of $255k and get this over with. We want to close the deal asap, so the offer is exclusive and valid for only 2 business days.
        

3/29/2021, 7:17:40 AM

          We have our weekly monday meeting this afternoon and I will tell them about the amount and the deadline. I also wish to get this over with.
        

3/29/2021, 5:17:50 PM

          Ok, get back to me when the meeting is over.
        

3/29/2021, 7:24:31 PM

          We are able to go up to $172,000. We are too close to the limit at which point we will have to halt and go through the top leadership approval process, which has a high risk of rejection. We do not want to risk them turning us away.
        

3/30/2021, 7:42:23 PM

          We agree to accept.
The btc wallet for the payment is : [redacted]
let me know as soon as the transfer is made.
        

3/30/2021, 8:47:19 PM

          Thank you. I will notify the cfo's office and instruct them to arrange it
        

3/31/2021, 5:24:45 PM

          I'm sorry for the delay on this. They've asked me to come in for a meeting in the morning to confirm the arrangement of payment. I will check in with you after
        

4/1/2021, 11:11:22 PM

          It's been a while, let me know when the meeting is over.
        

4/2/2021, 9:42:34 AM

          Thanks for waiting. I guess the executives read some concerning news reports this week that companies who are hit with ransom are getting published anyway even if they try to pay. It scared them. I will make sure it gets done on Monday after they calm down
        

4/2/2021, 9:44:05 PM

          We would never do such a thing that will hurt our reputation. The executives shouldn't be worried while dealing with our particular group.
        

4/3/2021, 8:54:37 AM

          I have been in meetings all day. Our leadership has seen more news reports over the weekend that the conti group is publishing people who are offering to pay and they are uncomfortable about this. You said you never do that, but that is not what we read in the news
        

4/5/2021, 8:45:14 PM

          I haven't seen these news actually and not sure what it is about.
        

4/6/2021, 11:52:50 AM

          We do publish people who do not pay for sure.
        

4/6/2021, 11:53:09 AM

          It says the company offered conti 500k for payment and they got published instead, even though they wanted to pay
        

4/6/2021, 2:03:38 PM

          https://www.insurancejournal.com/news/[redacted].htm
        

4/6/2021, 2:04:09 PM

          https://www.databreaches.net/[redacted]/
        

4/6/2021, 2:04:30 PM

          We haven't reached the agreement on the price. That's the only thing why they were published. We already have such an agreement with you - so that is not an issue.
        

4/6/2021, 2:05:56 PM

          Ok. This wallet still ok? [redacted]
        

4/6/2021, 4:02:49 PM

          Yes.
        

4/6/2021, 4:06:58 PM

          We are about ready. Are you online?
        

4/6/2021, 7:57:54 PM

          Before we continue, please confirm you will send: 1) decryptor for all systems 2) list of our files 3) tell us how you accessed our network 4) proof our files are destroyed and promise they will never be published
        

4/6/2021, 8:04:20 PM

          I do confirm each of those four.
By the way, according to our talk I might assume we've dealt before previously, am I right?
        

4/6/2021, 8:06:31 PM

          We have been talking in here for a while if that is what you mean. Are you ready for us to send?
        

4/6/2021, 8:08:39 PM

          Yes, we are ready to accept the payment.
And no, I meant your recovery company. Nevermind though, I might be mistaken.
        

4/6/2021, 8:11:31 PM

          The payment is done
        

4/6/2021, 8:52:45 PM

          I have already processed the request to the tech dept to provide the decryption tool the soonest possible.
        

4/6/2021, 8:54:49 PM

          What is approximate time to receive?
        

4/6/2021, 8:55:22 PM

          [redacted]-full-listing.txt [ 24.7MB ]
        

4/6/2021, 8:58:11 PM

          [redacted]_decryptor.exe [ 103kB ]
        

4/6/2021, 9:01:58 PM

          Please review the full listing and let us know when we can start shredding your data to provide the deletion log.
        

4/6/2021, 9:02:52 PM

          Ok thanks. I will let you know when its time
        

4/6/2021, 9:03:22 PM

          Decryptor:
1) Launch the decryptor under Administrative rights
2) Wait till the decryptor window is closed
3) if any of the files haven't changed the extension back to the original - repeat 1 and 2
        

4/6/2021, 9:03:41 PM

          Please keep our chat open while we work on decryption in case we have questions. It is still running
        

4/9/2021, 8:18:09 PM

          Sure, let me know when you're over and we will delete the chat.
        

4/9/2021, 8:23:55 PM

          Thanks for waiting. Please proceed with file shredding and send me the delete log when it is ready
        

4/19/2021, 8:55:03 PM

          Did you get my message
        

4/21/2021, 3:16:00 PM

          [redacted]-removed.log [ 18.8MB ]
        

4/21/2021, 4:21:30 PM

          Shall we delete this chat now?
        

4/22/2021, 12:36:19 PM

Negotiation Chat – Conti