extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Conti — 20210513

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 78 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Conti
Record date
May 13, 2021
Messages
78
Participants
Conti, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    readme.txt [ 1kB ]

  2. Message 002 From Victim Victim Date

    Waiting for instructions

  3. Message 003 From Conti Actor / other Date

    Welcome! [redacted]

  4. Message 004 From Conti Actor / other Date

    You need pay for decrypt your files. Your price is 200.000$

  5. Message 005 From Conti Actor / other Date

    Your network was hacked, workstations encrypted and we downloaded many private information from your servers. Note that we have also downloaded a lot of data from your network that in case of not making payment will be published on our website. If you will spend 3 days in silence we will start publushing the information.

  6. Message 006 From Conti Actor / other Date

    Your price for non-recoverable deletion of all the leaked information, and decpryptor for your network is $200.000

  7. Message 007 From Victim Victim Date

    Sorry for the delay, we've been having a lot of internal meetings and want to work with you.

  8. Message 008 From Conti Actor / other Date

    We understand your problems. But we also see your turnover and the amount of information we downloaded from your network. Your losses, if the information reaches the public, will be tens of times more than we asked. make your offer, you haven't given a single digit yet.

  9. Message 009 From Victim Victim Date

    Okay; as part of our conversations last night I was told to ask about getting a sample of data you might have taken

  10. Message 010 From Conti Actor / other Date

    We have your accounting, legal documents, finance, contracts and personal correspondence, DB, that's all I can say. It's about 50 Gigabate. You will receive a complete list of files after payment as well as a log of their removal from our server.

  11. Message 011 From Conti Actor / other Date

    [redacted]_proof.7z [ 3.1MB ]

  12. Message 012 From Conti Actor / other Date

    Proof Pack. Pass: 123123

  13. Message 013 From Conti Actor / other Date

    We will also try to find a buyer for your data and access to your network if you refuse to pay.

  14. Message 014 From Victim Victim Date

    Thank you; I will let my boss know. We want to work with you.

  15. Message 015 From Victim Victim Date

    We've been having some internal meetings and discussions and would like to make an offer of $22k

  16. Message 016 From Victim Victim Date

    Just wanted to follow up on this.

  17. Message 017 From Conti Actor / other Date

    Your offer has been rejected. Make a more reasonable offer based on our offer.

  18. Message 018 From Victim Victim Date

    I've went back to my boss and management, they understand the importance. We would like to extend an updated offer to $45K USD

  19. Message 019 From Conti Actor / other Date

    Well, we see constructive dialogue and make a discount. Your new price is $170,000.

  20. Message 020 From Victim Victim Date

    Let me check with my boss to what more we can offer, as that's still a lot of money for us.

  21. Message 021 From Victim Victim Date

    Just spoke with my boss and management was able to come up with some additional funds to make an offer of $62k

  22. Message 022 From Victim Victim Date

    Following up on the offer of $62k

  23. Message 023 From Conti Actor / other Date

    Well, we see constructive dialogue and make a discount. Your new price is $138,000.

  24. Message 024 From Victim Victim Date

    Let me talk to my boss, I will get back to you later this morning.

  25. Message 025 From Conti Actor / other Date

    Well, we are waiting, do not delay, this will entail negative consequences of publication.

  26. Message 026 From Victim Victim Date

    I was told to ask, if you can provide proof of decryption. Do I just upload a couple documents?

  27. Message 027 From Victim Victim Date

    [redacted].pdf.[redacted] [ 529kB ]

  28. Message 028 From Victim Victim Date

    Inventory Report [redacted].htm.xlsx.[redacted] [ 13kB ]

  29. Message 029 From Victim Victim Date

    [redacted] reimbursement Spreadsheet 7-29-2019.xlsx.[redacted] [ 11kB ]

  30. Message 030 From Victim Victim Date

    Hello?

  31. Message 031 From Victim Victim Date

    Have you gotten my messages?

  32. Message 032 From Conti Actor / other Date

    Wait.

  33. Message 033 From Conti Actor / other Date

    [redacted] reimbursement Spreadsheet 7-29-2019.xlsx [ 11kB ]

  34. Message 034 From Conti Actor / other Date

    Inventory Report [redacted].htm.xlsx [ 12kB ]

  35. Message 035 From Conti Actor / other Date

    [redacted].pdf [ 528kB ]

  36. Message 036 From Victim Victim Date

    Thank you; I'll let my bossy know

  37. Message 037 From Conti Actor / other Date

    Well, we are waiting, do not delay, this will entail negative consequences of publication.

  38. Message 038 From Victim Victim Date

    Should have a response here shortly, I know we have been discussing internally and trying to come up with some additional funds.

  39. Message 039 From Victim Victim Date

    We would like to make an additional offer; $74k

  40. Message 040 From Victim Victim Date

    Just wanted to follow up on the new offer of $74K

  41. Message 041 From Victim Victim Date

    ?

  42. Message 042 From Victim Victim Date

    Also, what would be the BTC Wallet for payment?

  43. Message 043 From Victim Victim Date

    Also, would we be able to get access to the data you have taken? Or something else like a file Tree?

  44. Message 044 From Conti Actor / other Date

    Your price for file tree & non-recoverable deletion of all the leaked information, and decpryptor for your network is $100.000. And we agree. We will not be able to make less than this proposal. Think about it.

  45. Message 045 From Conti Actor / other Date

    BTC Wallet: [redacted]

  46. Message 046 From Victim Victim Date

    If we can get payment over today, when should we expect the decryption key? I know comms have been rather slow.

  47. Message 047 From Conti Actor / other Date

    You'll get everything within 24 hours. after payment.

  48. Message 048 From Conti Actor / other Date

    We'll try to give it all out quickly.

  49. Message 049 From Victim Victim Date

    Is there a leak site we can check that you guys would publish to?

  50. Message 050 From Conti Actor / other Date

    http://continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion/

  51. Message 051 From Victim Victim Date

    Thank you;

  52. Message 052 From Victim Victim Date

    Just got confirmation from my boss, we are working to make the $100k payment.

  53. Message 053 From Conti Actor / other Date

    Okay, we're waiting.

  54. Message 054 From Victim Victim Date

    This is still the BTC Wallet Correct: [redacted]

  55. Message 055 From Conti Actor / other Date

    BTC Wallet: [redacted]

  56. Message 056 From Victim Victim Date

    Confirmation #: [redacted]

  57. Message 057 From Victim Victim Date

    Can you confirm payment? When should we expect the decryption key?

  58. Message 058 From Conti Actor / other Date

    [redacted]_decryptor.exe [ 103kB ]

  59. Message 059 From Conti Actor / other Date

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2

  60. Message 060 From Conti Actor / other Date

    The file tree and deletion log are expected to be checked out within 24 hours.

  61. Message 061 From Victim Victim Date

    Thank you

  62. Message 062 From Conti Actor / other Date

    Wait

  63. Message 063 From Victim Victim Date

    We have files that won't decrypt on several systems. I'm providing a few of those samples if you can update the decryption tool.

  64. Message 064 From Victim Victim Date

    [redacted]_.GIF.[redacted] [ 5kB ]

  65. Message 065 From Victim Victim Date

    [redacted].cab.[redacted] [ 8.6MB ]

  66. Message 066 From Victim Victim Date

    [redacted]_.WMF.[redacted] [ 6kB ]

  67. Message 067 From Victim Victim Date

    How long till we can get an updated decryption tool and file-tree & deletion of file-tree

  68. Message 068 From Conti Actor / other Date

    This 3 files are decrypted, just remove.[redacted] extension

  69. Message 069 From Victim Victim Date

    Your decryption tool left the extension to thousands, how do we go about removing the extension to thousands of files without potentially corrupting files that might still need to be decrypted.

  70. Message 070 From Conti Actor / other Date

    Try to run the decryptor again

  71. Message 071 From Victim Victim Date

    We did 3-4 times

  72. Message 072 From Victim Victim Date

    Any news on the updated decryption tool and file deletion?

  73. Message 073 From Conti Actor / other Date

    [redacted]_tree.zip [ 76kB ]

  74. Message 074 From Conti Actor / other Date

    SHRED_[redacted].zip [ 739kB ]

  75. Message 075 From Conti Actor / other Date

    file list and delete log

  76. Message 076 From Victim Victim Date

    Thank you; what about an updated decryption tool

  77. Message 077 From Victim Victim Date

    Really need that updated decryption tool. I've got thousands of files that I can't use and If I self remove thousands of extensions I fear that the files will be corrupted. You promised a working decryption key.

  78. Message 078 From Victim Victim Date

    I'm reaching out to the bigger Conti group.