Contact us Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Negotiation Chat — lockbit3.0

Negotiation chats provided by Valéry Marchive and Julien Mousqueton.

Chat ID: Leaked2025-ClientID-124

You can attach a few files for test decryption by packing them into an archive with zip, rar, tar, 7zip, 7z, tar.gz extensions of no more than 10 megabytes using the attach button directly in the chat.<br /><br />If your archive weighs more than 10 megabytes, please use our file sharing service.<br />http://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion<br />http://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion<br />http://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion<br />For security reasons we do not click on other links you send in chat.<br />Please wait for a reply, sometimes it takes several hours due to possible time zone differences.
2025-01-24 16:37:40
Gang
hi
2025-01-24 16:37:51
Gang
Victim
hi, I\'m here
2025-01-24 16:38:46
The previous public chat has been blocked. Now we can communicate with you privately.
2025-01-24 16:38:48
Gang
We know about the TOX conversation and that you have already agreed to a price of $50,000.<br /><br />When will you be ready to pay? How much time do you need?
2025-01-24 16:39:42
Gang
Victim
50,000 is really difficult for me. What is the lowest price you can give me?
2025-01-24 16:41:17
So in the last chat you agreed to the amount of 40,000 dollars.<br /><br />We do not agree with this price.<br />But we agree to give you a discount of 5,000 dollars, and the final price will be 45,000 dollars, but on one condition: that you make the payment within 24 hours.<br />Do you agree?
2025-01-24 16:45:03
Gang
Victim
I can get 30,000 today. The 40,000 would be for Monday. Also, in a few hours the banks close until Monday. I don\'t think I can make any payment in 24 hours.
2025-01-24 16:49:31
We offer you the following options:<br /><br />Main Option:<br />The main payment is due on Tuesday. Find an additional $5,000 to bring the total payment to $45,000.<br /><br />We are willing to offer you an alternate option:<br />If you make a $5,000 deposit today, we will give you a $5,000 discount and you can pay the balance of $35,000 on Monday or Tuesday.<br /><br />Which option do you choose?
2025-01-24 17:01:20
Gang
Victim
Ok I would accept the second option. Today I could transfer the 5000, I need the instructions. On the other hand, I would appreciate it if you could send me some other file, of your choice, so that I know that I am not spending the money uselessly.
2025-01-24 17:13:10
We always focus on the time zone UTC+0, so you have approximately 6.5 hours.
2025-01-24 17:24:17
Gang
Victim
Perfect. I\'m getting everything ready. I\'m waiting for the address.
2025-01-24 17:33:02
This is bitcoin wallet address for payment:<br />[redacted]
2025-01-24 17:55:12
Gang
We are currently preparing a partial file tree for you. This will take some time.
2025-01-24 17:56:15
Gang
Victim
Good
2025-01-24 18:41:30
2025-01-24 19:17:23
Gang
Please select a file and we will send you the original file.
2025-01-24 19:17:45
Gang
Victim
.\\Datos\\[redacted].txt
2025-01-24 19:30:44
Victim
Please, could you also confirm that you have the original .mfd files and show me their names?
2025-01-24 19:32:03
2025-01-24 20:19:13
Gang
Perhaps you are not talking about \"mfd\" files, but about \"mdf\" database files?
2025-01-24 20:20:20
Gang
All the files we downloaded from you are in perfect order, and they are whole and functioning.<br />We sent you a list of files, a partial file tree, which contains about 5% of all the files we downloaded. The full file tree + full logs of deleting these files from our servers you can get only after payment.
2025-01-24 20:24:32
Gang
Victim
Yes, sorry I mean MDF
2025-01-24 20:46:57
I see that these files are not in the partial file tree. They may be in the general list, but you will be able to see it only after payment. In any case, if these files are there, they are in perfect order. But you should not worry about this, because after payment you will also receive the decryption keys for the files, and you will be able to decrypt your files if they are encrypted and do not function for now.<br /><br />When will you make the payment? We have fulfilled the conditions on our side. You have about 3 hours left.
2025-01-24 20:52:32
Gang
Victim
Well, we trust you.<br />Payment will be made today. We are working on it.
2025-01-24 20:55:42
Ok, we are waiting.
2025-01-24 21:45:43
Gang
Victim
Ok, I\'m waiting for the dollar transaction to the wallet
2025-01-24 21:50:54
ok
2025-01-24 22:08:59
Gang
Victim
Done
2025-01-24 22:45:13
Victim
you need the id?
2025-01-24 22:46:24
Everything is fine. We have received your advance payment. We will wait for the rest of the money from you, Monday or Tuesday. $35,000.
2025-01-24 23:00:37
Gang
Victim
thanks
2025-01-24 23:01:22
Hello. We are expecting payment from you today, right?
2025-01-28 14:32:28
Gang
Victim
Good morning. Yes, I am waiting for the last loan I requested to be credited. I estimate that it will be resolved in 1 hour.
2025-01-28 14:50:16
Victim
Good afternoon. The bank tells me that the process has been accepted but the accreditation may take a while. In the meantime, I can transfer what I already have, which is 27,000.
2025-01-28 18:07:49
Victim
Hi, I already have the total. Should I send the 35,000 to the same wallet?
2025-01-28 19:27:59
Hello! Please wait, we will answer you soon
2025-01-28 20:10:03
Gang
Yes, that\'s right, you can send money to the same wallet.
2025-01-28 21:14:19
Gang
Victim
Payment has already been sent, it is pending
2025-01-28 21:37:13
Victim
The order was processed<br />
2025-01-28 21:52:40
We confirm receipt of funds. We will soon give you the decryption keys for the files, in this chat. We are also ready to begin the process of deleting all your files and creating deletion logs for you. Please let us know if you need a full file tree before we begin the process of deleting files. You will also see all these files in the deletion logs.
2025-01-28 22:17:50
Gang
Victim
Ok, I need the MDF files with the decryption key.<br />I have to be away for a few minutes. How long will it take you?
2025-01-28 22:29:10
It may not be fast, it is already late today. It may be tomorrow. I cannot give a time frame yet.
2025-01-28 22:30:07
Gang
Victim
Ok, I\'ll be back in an hour too. If you have the key for later that would be great.<br />
2025-01-28 22:31:56
2025-01-29 03:36:20
Gang
2025-01-29 03:36:27
Gang
Victim
Thank you, what is the procedure?
2025-01-29 04:59:01
The deletion process is in progress. Once completed, we will give you full logs of deleting all your files. Regarding the file decryption keys, have you figured it out yet?
2025-01-29 21:02:03
Gang
Victim
Yes, perfect. Thank you. I was able to recover the most important things. Could you give me some recommendations so that this doesn\'t happen again?
2025-01-30 02:05:24
Yes, of course, we will prepare it for you.
2025-01-30 13:11:25
Gang
Victim
Thank you. <br />Is there any way I can download the MDF files you have without encryption? The system provider tells me that they may be corrupted. Thank you.
2025-01-30 16:35:25
I not understand you
2025-01-30 21:45:25
Gang
We checked the file tree, unfortunately there are no mdf files among them. But our encryption does not damage files, check everything carefully.
2025-01-31 02:44:13
Gang
Hello<br />Your deletion files log:
2025-02-03 19:49:02
Gang
2025-02-03 19:49:08
Gang