Conti — 20210628

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Conti Actor / other Date 28/06/2021, 18:01:05

   Hello, are you ready to negotiate?

2. Message 002 From Victim Victim Date 03/07/2021, 13:32:04

   Yes tell me how much I have to pay. We are ready to pay you for our data. I have some questions also. after payment will you provide support service? And where I have to pay?

3. Message 003 From Conti Actor / other Date 04/07/2021, 19:52:51

   We will provide all the relevant information the soonest possible.

4. Message 004 From Conti Actor / other Date 05/07/2021, 15:10:30

   Please provide your company name

5. Message 005 From Conti Actor / other Date 06/07/2021, 14:26:54

   Let me know if you need the decryption tool. The price will be based on this fact.

6. Message 006 From Victim Victim Date 09/07/2021, 11:43:33

   company name is [redacted] now help us fast please

7. Message 007 From Victim Victim Date 09/07/2021, 11:43:50

   please keep the price low it's a request

8. Message 008 From Conti Actor / other Date 09/07/2021, 11:45:19

   We will discuss and let you know within few minutes.

9. Message 009 From Victim Victim Date 09/07/2021, 11:45:42

   okay please stay online

10. Message 010 From Conti Actor / other Date 09/07/2021, 11:47:37

    Are you acting on behalf of [redacted]?

11. Message 011 From Conti Actor / other Date 09/07/2021, 11:52:04

    Please provide us two files for the test decryption.

12. Message 012 From Victim Victim Date 09/07/2021, 12:07:03

    ok wait

13. Message 013 From Victim Victim Date 09/07/2021, 12:14:03

    desktop.ini.[redacted] [ 708B ]

14. Message 014 From Victim Victim Date 09/07/2021, 12:14:09

    ntuser.ini.[redacted] [ 554B ]

15. Message 015 From Victim Victim Date 09/07/2021, 12:14:58

    now help us fast please with your price and address. One question after payment in how much time we will get the decryptor??

16. Message 016 From Victim Victim Date 09/07/2021, 12:55:28

    Are you there?? We are waiting for your reply?? How long we have to wait for it?

17. Message 017 From Conti Actor / other Date 09/07/2021, 13:02:00

    we will provide the decrypted copies soon. Right now we are trying to figure out what of your resources were attacked, cause for now as we can see this particular strain of Conti was used in [redacted] network, so I ask you again, are you talking to us on their behalf?

18. Message 018 From Conti Actor / other Date 09/07/2021, 13:02:20

    As soon as the payment is made the decryption tool will be provided within 20-30 minutes.

19. Message 019 From Victim Victim Date 09/07/2021, 13:03:20

    Yes we are talking on behalf of them

20. Message 020 From Conti Actor / other Date 09/07/2021, 13:03:52

    Do you need the list of the data that was taken from their network?

21. Message 021 From Conti Actor / other Date 09/07/2021, 13:04:49

    The price for the decryption tool and the data for lounsburys.com is $1.25mil

22. Message 022 From Victim Victim Date 09/07/2021, 13:05:01

    if you can provide it will be good

23. Message 023 From Victim Victim Date 09/07/2021, 13:05:11

    Can you please provide some discount??

24. Message 024 From Conti Actor / other Date 09/07/2021, 13:06:26

    We can make 25% discount if the payment will be made within 24 hours.

25. Message 025 From Conti Actor / other Date 09/07/2021, 13:08:17

    desktop.ini [ 174B ]

26. Message 026 From Conti Actor / other Date 09/07/2021, 13:08:22

    I've processed the request for the file tree list and example data pack to the tech dept. Will upload as soon as they reply

27. Message 027 From Victim Victim Date 09/07/2021, 13:08:31

    Ok and where we have to pay??

28. Message 028 From Conti Actor / other Date 09/07/2021, 13:08:32

    ntuser.ini [ 20B ]

29. Message 029 From Conti Actor / other Date 09/07/2021, 13:09:03

    The btc wallet for the payment is: [redacted]

30. Message 030 From Victim Victim Date 09/07/2021, 13:13:41

    Can you please provide non-segwit address if you don't have any problem

31. Message 031 From Victim Victim Date 09/07/2021, 13:15:20

    Can we request one more thing please?? Amount is very huge.. can you accept the money into multiple addresses, if you don't have any problem. We will try to pay with diff-diff wallets. I hope you understand our situation. It's a humble request

32. Message 032 From Conti Actor / other Date 09/07/2021, 13:18:13

    Here's the list of addresses for the payment, all are non-segwit: [redacted] [redacted] [redacted] [redacted] [redacted]

33. Message 033 From Conti Actor / other Date 09/07/2021, 13:26:27

    Let me know if you've received the addresses. I will have to go offline for a couple of hours but I will be able to get back to you later today.

34. Message 034 From Victim Victim Date 09/07/2021, 13:31:59

    ok we are talking to higher management with all the details and I will update you by EOD otherwise tomorrow. We will try to pay you by today if higher mangement approves everything