Conti — 20210107
Dated recordFrom extortion.wiki, the ransomware negotiation research archive
A validated static rendering of 139 messages in source-array order. Transcript text is preserved without editorial additions.
- Actor
- Conti
- Record date
- Jan 07, 2021
- Messages
- 139
- Participants
- Conti, Victim
Preserved messages
Actor / other Victim
Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.
-
Message 001 From Victim Victim Date [redacted]: Please contact me as soon as possible. [redacted]@gmail.com
-
Message 002 From Victim Victim Date [redacted]: readme.txt [ 866B ]
-
Message 003 From Conti Actor / other Date Support: Hi. Could you introduce yourself?
-
Message 004 From Victim Victim Date [redacted]: My name is [redacted] and I got a message to contact you in regards to an encryption on my computer.
-
Message 005 From Victim Victim Date [redacted]: are you the person I need to contact to help me? I sent my email and name to you as you asked.
-
Message 006 From Conti Actor / other Date Support: Your network was ATTACKED, your computers and servers were LOCKED. Take into consideration that we have also downloaded data from your network that in case of not making payment will be published on our news website. After the payment you will get decryptor to all your systems, full file tree of downloaded data, non-recoverable deletion with proof log and security report on how you were hacked. We downloaded all employees private info, company's financial documents and etc. In case of not making payment will be also published. More than terabyte of private information has been downloaded from your servers. Including financial data of your company, personal data of your employees and their family members, company agreements, and most importantly.
-
Message 007 From Victim Victim Date [redacted]: What do I need to do?
-
Message 008 From Conti Actor / other Date Support: Overall price is $900,000. For this price you will get everything mentioned above. Please pass this information on to your management. In the future, we are ready to communicate only with the representative who can make such decisions. We are ready to provide you with a small set of files from different servers of your company.
-
Message 009 From Victim Victim Date [redacted]: I am authorized to speak on behalf of the company. Are you the person who sets this price for regaining access to everything?
-
Message 010 From Victim Victim Date [redacted]: hello, are you still there?
-
Message 011 From Victim Victim Date [redacted]: Is there anyone there? Please at least email me at [redacted]@gmail.com so I can continue to work through this with you.
-
Message 012 From Conti Actor / other Date Support: We are here.
-
Message 013 From Conti Actor / other Date Support: Are you ready to transfer money?
-
Message 014 From Victim Victim Date [redacted]: Yes. I would like to fix the problem but I don't have this amount of money. Please tell me how we can resolve.
-
Message 015 From Conti Actor / other Date Support: According to the public records your revenue is [more than 30],000,000$, so this price is reasonable. https://www.dnb.com/business-directory/company-profiles.[redacted].html Also you should remember that the price is much cheaper then you will pay lawsuits, that your clients will send you and government fines, because you have lost so much of their data.
-
Message 016 From Victim Victim Date [redacted]: We would like to fix this problem but we have been out of service during Covid and do not have this amount of money. I am trying to fix and please let me know what we can do.
-
Message 017 From Conti Actor / other Date Support: What is your best proposal?
-
Message 018 From Victim Victim Date [redacted]: I have the ability to send 20,000 as soon as I can transfer money. I would like to get this fixed and please let me know if we can get this fixed.
-
Message 019 From Victim Victim Date [redacted]: How can we test to see if this can be fixed?
-
Message 020 From Conti Actor / other Date Support: We could not accept that offer, but we could reduce the price and give you the new one 800,000$. We could decrypt 1-2 files as samples.
-
Message 021 From Victim Victim Date [redacted]: [redacted].docx.[redacted] [ 15kB ]
-
Message 022 From Victim Victim Date [redacted]: [redacted].docx.[redacted] [ 13kB ]
-
Message 023 From Victim Victim Date [redacted]: Here are two samples. Can you open them?
-
Message 024 From Conti Actor / other Date Support: Yes. But today is weekend and we will decrypt them tomorrow.
-
Message 025 From Victim Victim Date [redacted]: We we are not comfortable paying until you are able to decrypt these samples. Did you take data from us as well? We have a small window of time where buying your keys is useful as we are working on a rebuild. We have a meeting early tomorrow morning, so I will ask you send us: 1) your nest offer, 2 proof that you can decrypt, 3 proof of whatever you claim you stole. $800,000 is still an insane price for us, so if you want us to even consider this, please be realistic. Please send us #1, #2 and #3 as soon as you can. Thank you.
-
Message 026 From Victim Victim Date [redacted]: Are you there? Can you decrypt my files? What files did you take? I'm willing to pay you very quickly to unlock my files, but $800k is impossible. If you can prove these things and offer a realistic price, I'll pay you right away. Thank you.
-
Message 027 From Conti Actor / other Date Support: Yes. We are here and provide samples very shortly.
-
Message 028 From Conti Actor / other Date Support: The price is more then realistic for company with so revenue. What is your best proposal?
-
Message 029 From Conti Actor / other Date Support: [redacted].docx [ 12kB ]
-
Message 030 From Conti Actor / other Date Support: [redacted].docx [ 15kB ]
-
Message 031 From Victim Victim Date [redacted]: Thank you. I'm waiting for information about what files you took. Regarding our revenue, if this happened last year at this time, paying this much wouldn't have been a problem. But with the pandemic and financial crisis, people just aren't buying cars. We have a large inventory that isn't selling and by holding onto this inventory like we are, we're actually losing more money than making money. It will take us months to crawl out of this problem to start making a profit. Revenue is not profit, as you know.
-
Message 032 From Conti Actor / other Date Support: The static shows opposite. A lot of sources say that people start to buy cars more, because of pandemic. Anyway what is your best proposal?
-
Message 033 From Victim Victim Date [redacted]: The boss is meeting his financial advisor to find out how much we can afford to pay. I'll let you know. In the meantime, since you say you took files from us, are you able to show us?
-
Message 034 From Conti Actor / other Date Support: Yes. We could forward you several samples.
-
Message 035 From Victim Victim Date [redacted]: Thanks. If the price is something we can afford and we can pay, what do we get?
-
Message 036 From Conti Actor / other Date Support: We wrote you previously. We will give you decrypt tool for all your machines, security report on how you were hacked, file tree on what we have downloaded from your network and wiping log of that information.
-
Message 037 From Conti Actor / other Date Support: Here is several samples: https://www.sendspace.com/file/[redacted] https://www.sendspace.com/delete/[redacted] pass [redacted]
-
Message 038 From Victim Victim Date [redacted]: Thanks. Is this all you took?
-
Message 039 From Conti Actor / other Date Support: NO. We took much more, around 1 terabyte. We wrote that previously too, including the data of clients and employees.
-
Message 040 From Victim Victim Date [redacted]: What computers did you take files from? 1 tb is a lot of files. Why only 7 files as proof?
-
Message 041 From Conti Actor / other Date Support: It is more then enough. You should understand that downloading data is very easy process when you have an access to the whole system.
-
Message 042 From Victim Victim Date [redacted]: Can you let me know what computers files came from? Or provide a list of files?
-
Message 043 From Conti Actor / other Date Support: It is impossible to make so big list. We will try to make a list of servers and desktops.
-
Message 044 From Conti Actor / other Date Support: [redacted].[redacted].local [redacted]ToyDC01.[redacted].local [redacted]GMCDC01.[redacted].local [redacted]oloDC01.[redacted].local [redacted]HonDC01.[redacted].local [redacted]ingDC01.[redacted].local [redacted]MazDC01.[redacted].local [redacted]aprdc01.[redacted].local [redacted]lbqDC01.[redacted].local [redacted]IFP.[redacted].local [redacted]oloHV01.[redacted].local [redacted]oloAPP01.[redacted].local [redacted]oloEX02.[redacted].local [redacted]ways.[redacted].local
-
Message 045 From Victim Victim Date [redacted]: Are these the computers you took files from?
-
Message 046 From Conti Actor / other Date Support: NO. That is just a list of servers. We did not make a list of desktops, we usually took from all.
-
Message 047 From Victim Victim Date [redacted]: Okay. Of all these 1 TB of files you took, you can only show me 7 files?
-
Message 048 From Victim Victim Date [redacted]: We're working on how much we can afford to pay you, but my boss is asking for some more information. Are you able to send some more files? 7 files is a tiny amount when you say you took 1 TB.
-
Message 049 From Conti Actor / other Date Support: Here is several more files: Download: https://qaz.im/load/[redacted] Delete: https://qaz.im/index.php?a=delete&q=[redacted] pass [redacted]
-
Message 050 From Victim Victim Date [redacted]: We reviewed the financials and we can pay you $72,380, but only if you promise to make all our files open and usable again and give back all the files you took.
-
Message 051 From Conti Actor / other Date Support: That is not enough. We could reduce the price and give you a new offer 700,000$. You should remember that the price is much cheaper then you will pay lawsuits, that your clients will send you and government fines, because you have lost so much of their data(Ids, ssn, credit cards).
-
Message 052 From Victim Victim Date [redacted]: I can see why you would think that. In reality, regardless if the files you took end up on your news site or not, I still have the same legal requirements and exposure. This was the case the second the files were taken, not if the files get posted or not. I have already begun the notifications to everyone whose data was affected, so it doesn't matter if the files are posted or not. Now, would I prefer the files not be posted, of course I would. Only because I care about my employees and my customers.
-
Message 053 From Victim Victim Date [redacted]: You need to understand that the reason I'm here is to get my files unlocked. I'm already taking a huge financial hit taking care of the legal notifications and the fees associated with that. I just want my files back and unlocked.
-
Message 054 From Victim Victim Date [redacted]: I spent all weekend with my finance guy reviewing the accounts and savings and were able to pull together $72,380. Business has not been good during the past year and what you're asking for is impossible. With COVID and the financial crisis, many people are out of work and aren't making large purchases. The people who are lucky enough to still have jobs are working from home and aren't buying new cars. I know you are the only person who can unlock the files, so this is why I'm willing to pay you the $72,380 that I have left. You can understand my situation, right?
-
Message 055 From Conti Actor / other Date Support: We don't think, that our estimates are incorrect. Your financial reports are somewhat more reliable, than your word here and now. And your proposal here is just from the textbooks - ten times less, than our initial demand. It seems, that you do not understand, how works our group. We don't ask $20 millions, to receive our demand of $750,000.So you should understand, that our team have plenty of projects running, and yours - just one from many. If we don't reach an agreement, we'll just shorten our profit.
-
Message 056 From Conti Actor / other Date Support: Also, your notifications will not save private data of your employees and customers, it will be used long time in many bad purposes. Think about your reputation, which will be damaged in so hard times for business.
-
Message 057 From Victim Victim Date [redacted]: I understand what you're saying and know you are a famous group. I have Googled you and know you are professionals. I know you do this all the time, but please put yourself in my shoes for a moment. There is nothing textbook about this. Nobody saw this pandemic and financial crisis coming. I had no idea that 2020 was going to be as bad as it was. I still have inventory on my lot from 13 months ago. That's unheard of in my business! I'm hoping 2021 turns around and is better, but until then, I'm just trying to survive. Car dealerships are very low margin, meaning that if I'm able to sell a few cars, the revenue doesn't necessarily cover my bills or employee salaries. I need to sell a certain level of inventory to make a profit and most months I didn't. I've had to furlough employees just to try to keep the dealership open. I'm willing to do whatever it takes and to work with you for as long as it takes, but I only have $72,380 that I can pay you to unlock my files.
-
Message 058 From Conti Actor / other Date Support: Of course, we understand, that your work here is not easy and requires efforts to convince your board members. But we are still far from agreement. Our estimates are still much higher, than your proposal. We hope, that you will give us better price. And since it is our mutual interest to speed up our negotiations as much, as we can - take more serious steps toward us. It would be much easier than for us to make steps to you in response.
-
Message 059 From Victim Victim Date [redacted]: I want to get you your money to get my files back. I know you put time and effort into this and want to get paid. We both want the same thing here. You see this, right? The only obstacle that I have that I need your help with is the high price. I just don't have that much. I worked to get $72,380 from my accounts to pay you.
-
Message 060 From Conti Actor / other Date Support: That is not enough. There is many ways how you could get additional funds. You could apply on the loan in the bank or take out your savings or cut expenses or sell something and etc. You are just wasting time now.
-
Message 061 From Victim Victim Date [redacted]: I don't understand why the price is so high. You obviously know what my financial situation is and know that I can't possibly afford to pay you this much. For a bank to give me a loan, they'll examine my current situation, look at my debt to income ratio and see if I'm actually profitable. I already know what they're going to tell me. I'm too risky. Can't we skip all of this time wasting and let me pay you?
-
Message 062 From Conti Actor / other Date Support: OK. We could reduce the price and offer the new amount 500,000$. The price is more then reasonable for that data and your reputation.
-
Message 063 From Victim Victim Date [redacted]: How is asking for over $400k more than what I can afford to pay you help our situation?
-
Message 064 From Conti Actor / other Date Support: We told you above that there is several ways to find additional funds.
-
Message 065 From Victim Victim Date [redacted]: I'm meeting with a loan officer at the bank today.
-
Message 066 From Conti Actor / other Date Support: Keep updating us please.
-
Message 067 From Victim Victim Date [redacted]: Good news. We were approved for a loan for the amount of $45,500. This makes the total amount that I can pay you $117,880. I requested $400k, but due to my debt-to-income ratio and current liabilities, $45,500 is the most they could approve for me. I have contact other lending firms and they all tell me that's the most I can be approved for, based on my credit and current financials.
-
Message 068 From Victim Victim Date [redacted]: We've been at this over a week now. We both want the same thing, a payment to get data back. I've done all I can at this point. Please, can we agree so I can pay you? This is why you did this, right?
-
Message 069 From Conti Actor / other Date Support: We need some time to discuss this offer.
-
Message 070 From Victim Victim Date [redacted]: This is a long holiday weekend and if I can't pay soon, I won't be able to until mid-next week.
-
Message 071 From Conti Actor / other Date Support: We could the offer today but it should be more profitable. We could give you some more discount and offer new price 400,000$.
-
Message 072 From Victim Victim Date [redacted]: I don't understand. I've pulled all the cash from out of the business and I put my neck out on the line for a loan to come up with $117,880. I don't have any other options. $400k is impossible for me. I can pay you $117,880 right away. It will take weeks or months before I can pay anything close to $400k.
-
Message 073 From Victim Victim Date [redacted]: Are you there? Please let me know if I can pay you $117,880. I understand that you want to make good money for your work, but this is as much as I can possible pay. I can't get another loan.
-
Message 074 From Conti Actor / other Date Support: We looked throw your finance records, bank accounts and know that you have more available funds. We are ready to give you some discount, but that price is not reasonable. We own a lot of private data which cost much more.
-
Message 075 From Victim Victim Date [redacted]: I had to meet with a loan advisor to get more funds to pay you. I want to fix this problem and work with you but I can't afford anymore then $117,880. This is all I have. We have been out of service during Covid and I can't come up with anymore money.
-
Message 076 From Conti Actor / other Date Support: You have more funds on your accounts.
-
Message 077 From Conti Actor / other Date Support: We are ready to accept 200,000$.
-
Message 078 From Conti Actor / other Date Support: Are you ready to pay?
-
Message 079 From Victim Victim Date [redacted]: I need to meet with the bank to see what my options are and how much more I can borrow. Monday is a federal holiday and the bank is closed. I'll meet with them first thing in the morning on Tuesday and I'll let you know.
-
Message 080 From Victim Victim Date [redacted]: How do I pay you? Would the bank pay you?
-
Message 081 From Conti Actor / other Date Support: We accept only bitcoins.
-
Message 082 From Victim Victim Date [redacted]: Okay I'll start looking into bitcoin as well. I'll have an update tomorrow
-
Message 083 From Conti Actor / other Date Support: There is several ways how you could exchange funds. You should check google and choose the most convenient for you.
-
Message 084 From Victim Victim Date [redacted]: I found a good bitcoin site. I have a call with the bank in a little bit and I'll let you know how it goes.
-
Message 085 From Conti Actor / other Date Support: OK. Keep updating us please.
-
Message 086 From Victim Victim Date [redacted]: It took some convincing, but I was able to get a $27,000 addendum to my previous loan. With the total loan amount of $72,500 and everything from my accounts, I can pay you $144,880. I have a bitcoin wallet account all set up and ready to use.
-
Message 087 From Conti Actor / other Date Support: We reduce price as much as we can. We totally sure that you had sales during this time, so you have sources from where you could add funds.
-
Message 088 From Victim Victim Date [redacted]: There have been no sales since this attack. You have locked up all the computers, leaving me not able to operate at all. This is why I've been working on getting a loan and begging and borrowing money from anyone I can.
-
Message 089 From Conti Actor / other Date Support: We went as low as we could. The price is little more then 20% from starting amount. It is very huge discount, especially if we remind that we own a lot of valued documents, credit cards and etc. We could not cut our profit anymore.
-
Message 090 From Conti Actor / other Date Support: I made a request to my managers about additional discount anyway.
-
Message 091 From Victim Victim Date [redacted]: Thank you. I really want to pay you to get my computers unlocked.
-
Message 092 From Conti Actor / other Date Support: We understand that and that's why we gave you so huge discount. We do not have purpose to ruin your business.
-
Message 093 From Victim Victim Date [redacted]: I understand. We both want the same thing. We both want a payment so I can get my files back. I'm short $55k and have no other options.
-
Message 094 From Conti Actor / other Date Support: We are ready to reduce a little more a price. The new offer is $185,00.
-
Message 095 From Victim Victim Date [redacted]: Okay, thank you. I'll need more time to find the funds. In addition to getting my files unlocked, what else does a payment get me?
-
Message 096 From Conti Actor / other Date Support: We will return all your data and provide security report.
-
Message 097 From Victim Victim Date [redacted]: What about the files you took? You will give that back as well? How does that work? Will you be able to provide proof that you deleted all the files?
-
Message 098 From Conti Actor / other Date Support: We will give you all files and delete them from the cloud. It is not a problem. We never treat clients who paid us, we play only fear games.
-
Message 099 From Victim Victim Date [redacted]: I'm trying today to collect more money for you.
-
Message 100 From Conti Actor / other Date Support: OK. Keep updating us please
-
Message 101 From Victim Victim Date [redacted]: I'm sorry to say this, but I still only have $144,880. I'm short a little more than $55k. The bank refuses to lend me more. I tried a couple special financing companies, but after running my credit, refuse to lend me any funds. I've asked friends and family and all are hurting more than me and can't help. I just don't know what to do now.
-
Message 102 From Conti Actor / other Date Support: OK. So we could split the payback. You pay us what you have now and we provide you the decrypt tool. After you pay the rest, we provide your data back.
-
Message 103 From Victim Victim Date [redacted]: I don't feel comfortable splitting up the payments. I rather pay you once and be done forever.
-
Message 104 From Victim Victim Date [redacted]: I know you must do this all day, but I just don't see how $144,880 isn't enough to unlock my files.
-
Message 105 From Conti Actor / other Date Support: It is not enough compare to your revenue and data which we got from you. So you could use this option and pay in two steps. You could start to work properly even today and find the rest very fast.
-
Message 106 From Victim Victim Date [redacted]: I'll need more time to collect more money. I don't have a lot of options left. The business is closed down because of this attack. I'll see what I can do. If I can't pay, can I come back here in a couple of month when I have the money? Will you still be here?
-
Message 107 From Conti Actor / other Date Support: We could not wait also. Why could you just split the payback and start to work today?
-
Message 108 From Victim Victim Date [redacted]: Because I'm scarred to death about paying all I have today and this still going on. No offense to you at all when I say this, but this has been the worst experience of my life. All I want is for this to be over. The stress and anxiety has been unbearable.
-
Message 109 From Conti Actor / other Date Support: We understand that and this is a reason why we gave so huge discount and offer you to split the payment. It is good option for you. The company will start to work today and you could earn the little rest very fast.
-
Message 110 From Victim Victim Date [redacted]: I'm working on collecting more money for you today.
-
Message 111 From Victim Victim Date [redacted]: Okay, I got $162,792. This is from an extra $17,912. $9,500 was from a personal loan, $3,655 is from personal savings and $4,757 is from a collection the workers did. This puts me at $162,792 that I can pay you. I literally have nothing else to give. I owe a huge debt of gratitude to my workers for their help and need to pay them back ASAP. I have a bitcoin wallet account ready, all I need to do is transfer the funds from the bank. Please let me know.
-
Message 112 From Conti Actor / other Date Support: OK. We could accept that price. Here is the wallet: [redacted]
-
Message 113 From Victim Victim Date [redacted]: Thank you. I'm working on getting the money transferred from my bank to the bitcoin account.
-
Message 114 From Victim Victim Date [redacted]: After I pay, you will give me a tool to unlock all my files, right? You will also give back all the files you took, prove you deleted them and give me information about how you got in so I can make sure this doesn't happen again?
-
Message 115 From Conti Actor / other Date Support: That is correct. As soon as we receive payment we provide required info.
-
Message 116 From Conti Actor / other Date Support: How is it going so far?
-
Message 117 From Conti Actor / other Date Support: When do you expect to proceed with the payment?
-
Message 118 From Conti Actor / other Date Support: You should confirm the wallet before transfer.
-
Message 119 From Victim Victim Date [redacted]: Hi. I had trouble with my bank. They didn't allow me to transfer the funds to a my bitcoin wallet because they suspected fraud. I got it cleared up and the wire has started, but it hasn't arrived yet. Because it didn't arrive today, it won't arrive until Monday morning. Is this okay??? Before I transfer the money to you, I will reconfirm your wallet.
-
Message 120 From Conti Actor / other Date Support: OK. Keep updating us please.
-
Message 121 From Victim Victim Date [redacted]: All ready to send you $162,792. Is your BTC wallet still [redacted]? If it changed, please let me know.
-
Message 122 From Conti Actor / other Date Support: Here is the new wallet: [redacted]
-
Message 123 From Victim Victim Date [redacted]: Okay, sending $162,792 to [redacted]
-
Message 124 From Victim Victim Date [redacted]: Just confirming, [redacted]. You said it's new, but it's the same one you provided last week. It's still the correct wallet?
-
Message 125 From Conti Actor / other Date Support: That is correct.
-
Message 126 From Conti Actor / other Date Support: Did you make a transfer?
-
Message 127 From Victim Victim Date [redacted]: Yes
-
Message 128 From Victim Victim Date [redacted]: https://www.blockchain.com/btc/tx/[redacted]
-
Message 129 From Victim Victim Date [redacted]: Do you see the payment?
-
Message 130 From Conti Actor / other Date Support: We received payment and provide required info shortly.
-
Message 131 From Victim Victim Date [redacted]: Thanks
-
Message 132 From Conti Actor / other Date Support: 1. The decryption tool uploaded to the cloud. You should launch it with administrator rights and wait until it finishes decryption process. Download: https://qaz.im/load/[redacted] Delete: https://qaz.im/index.php?a=delete&q=[redacted]
-
Message 133 From Conti Actor / other Date Support: 2. Here is the web links on your data: pass: [redacted] Download: https://qaz.im/load/[redacted] Delete: https://qaz.im/index.php?a=delete&q=[redacted] https://www.sendspace.com/file/[redacted] https://www.sendspace.com/delete/[redacted] Download: https://qaz.im/load/[redacted] Delete: https://qaz.im/index.php?a=delete&q=[redacted] https://www.sendspace.com/file/[redacted] https://www.sendspace.com/delete/[redacted] https://www.sendspace.com/file/[redacted] https://www.sendspace.com/delete/[redacted]
-
Message 134 From Victim Victim Date [redacted]: 1.rar, [redacted].rar and [redacted]2.rar are empty. Can you send via sendspace?
-
Message 135 From Victim Victim Date [redacted]: 1.rar has the decryption tool in it. It's not opening. Please resend via sendspace. Thank you!
-
Message 136 From Victim Victim Date [redacted]: What is the password for 1.rar? (the decryption tool)
-
Message 137 From Conti Actor / other Date Support: Here is password: [redacted]
-
Message 138 From Victim Victim Date [redacted]: Thank you! [redacted].rar and [redacted]2.rar are empty. Can you send via sendspace?
-
Message 139 From Victim Victim Date [redacted]: Hello? Two of the.rar files you sent via qaz.com were ZERO bytes. Please resend [redacted].rar and [redacted]2.rar via sendspace. Thank you