Conti — 20210902

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date 2/9/2021, 9:38:39 AM

   Hi Are you there? I need your help urgently kindly reply me. My system is behaving abnormally after infected by your ransomware.

2. Message 002 From Conti Actor / other Date 2/9/2021, 9:48:37 AM

   Yes, we are here. Will provide further details within next few minutes.

3. Message 003 From Conti Actor / other Date 2/9/2021, 9:52:32 AM

   As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website https://continews.best/ (TOR mirror: http://fylszpcqfel7joif.onion). The recovery price is $850000 in bitcoin. If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner, you've waited too long to contact us and the press-release is already ready for publication.

4. Message 004 From Victim Victim Date 2/9/2021, 10:01:20 AM

   Please don't publish our data anywhere

5. Message 005 From Victim Victim Date 2/9/2021, 10:01:58 AM

   Tell me your demand how we can fix this thing?

6. Message 006 From Conti Actor / other Date 2/9/2021, 10:13:15 AM

   Please read the previous message once again. The recovery price is $850000 in bitcoin.

7. Message 007 From Victim Victim Date 2/9/2021, 10:19:00 AM

   It's so much? No Discount?

8. Message 008 From Conti Actor / other Date 2/9/2021, 10:21:54 AM

   You have been waiting to contact us for about three weeks while ignoring our emails and still ask for a discount? It's a luck that you data isn't published yet. It's way past the deadline.

9. Message 009 From Victim Victim Date 2/9/2021, 10:27:03 AM

   I know that I wasted so much time in thinking whether to pay or not but now I am ready to do payment atleast provide some discount please

10. Message 010 From Conti Actor / other Date 2/9/2021, 10:29:57 AM

    We can provide a 25% discount by going down to $635k if the payment will be made by the end of this week.

11. Message 011 From Victim Victim Date 2/9/2021, 10:37:06 AM

    Ok I am ready with this price tell me where I have to pay?

12. Message 012 From Conti Actor / other Date 2/9/2021, 10:40:54 AM

    The btc wallet for the payment is: [redacted] Let me know as soon as the payment is made.

13. Message 013 From Victim Victim Date 2/9/2021, 10:58:53 AM

    Thanks for the discount. Just want to ask one thing. Is your bitcoin address correct? I am getting issue while doing payment on your given address

14. Message 014 From Conti Actor / other Date 2/9/2021, 11:00:23 AM

    Yes, it is correct, but it's a segwit address. I will provide a new one within few minutes.

15. Message 015 From Conti Actor / other Date 2/9/2021, 11:01:23 AM

    You can use this one: [redacted]

16. Message 016 From Victim Victim Date 2/9/2021, 11:07:11 AM

    Thanks but it's not working is it segwit address or what? both the address are throwing same error. Might be because your address is new or created on blockchain and due to that I am getting the error.

17. Message 017 From Conti Actor / other Date 2/9/2021, 11:10:41 AM

    It is a new address, but that should not be an issue. What's the error code?

18. Message 018 From Victim Victim Date 2/9/2021, 11:15:17 AM

    Error code is "Transaction Server Failed" Might be because your address is new and empty. If you can provide me another address that have some balance probably it will work sometimes it happened due to zero or null value in blockchain if I am not wrong

19. Message 019 From Conti Actor / other Date 2/9/2021, 11:18:14 AM

    Try this one: [redacted]

20. Message 020 From Victim Victim Date 2/9/2021, 11:21:52 AM

    Thanks for your kind support but I think segwit it creating some issue can your provide non-segwit & non-empty address.

21. Message 021 From Conti Actor / other Date 2/9/2021, 11:28:50 AM

    Give me few minutes, I will try to find one.

22. Message 022 From Victim Victim Date 2/9/2021, 11:29:41 AM

    Ok no issue & Thanks once again for the discount

23. Message 023 From Conti Actor / other Date 2/9/2021, 11:30:53 AM

    That's not a common issue, have you tried to increase the fee? The blockchain network seems pretty busy today.

24. Message 024 From Victim Victim Date 2/9/2021, 11:33:48 AM

    I tried but it doesn't work for me. I know sometimes it happens in blockchain due to network issue so, I am not blaming you

25. Message 025 From Victim Victim Date 2/9/2021, 11:34:50 AM

    Btw Thanks for your amazing support service I thought that ransomware guys never respond properly but after talking to you I was wrong

26. Message 026 From Conti Actor / other Date 2/9/2021, 11:37:05 AM

    Glad to hear it. I am trying to find a suitable legacy wallet, but the fact is that we almost never use them, so it might take some time. Anyways, if you will be able to transfer the funds to any of the above wallets we will accept the deposit and provide you with a decryptor. Those three wallets are static and under our control.

27. Message 027 From Victim Victim Date 2/9/2021, 11:38:57 AM

    Meanwhile I will try no issue I understand your situation. If you have some more addresses and don't have any problem I will try on others if it works I will let you know

28. Message 028 From Victim Victim Date 2/9/2021, 11:43:32 AM

    [redacted] kindly check the payment on this address I just tried again I think funds has been transferred

29. Message 029 From Victim Victim Date 2/9/2021, 11:47:22 AM

    No need to check on that address again I got the error message

30. Message 030 From Conti Actor / other Date 2/9/2021, 11:54:15 AM

    [redacted] - try this.

31. Message 031 From Victim Victim Date 2/9/2021, 11:57:36 AM

    Same thing happening... you don't have legacy address with some balance. Blockchain network facing load issue I believe

32. Message 032 From Conti Actor / other Date 2/9/2021, 12:01:02 PM

    They are accumulated, so it basically has the parent balance. Nevermind, it seems to be a network issue due to high load, so let's just wait abit and keep trying within some interval.

33. Message 033 From Victim Victim Date 2/9/2021, 12:03:37 PM

    No Issue, I was also thinking the same I will try it like this only

34. Message 034 From Victim Victim Date 2/9/2021, 12:04:11 PM

    Can I ask few questions if you don't have any problem to answer? I am very curious to know about few things

35. Message 035 From Conti Actor / other Date 2/9/2021, 12:07:14 PM

    Sure, go ahead.

36. Message 036 From Victim Victim Date 2/9/2021, 12:09:03 PM

    Like why you started this ransomware business? How much you earned in this business?

37. Message 037 From Conti Actor / other Date 2/9/2021, 12:11:38 PM

    Oh, "those" questions. Unfortunately we have no interest in giving interviews, although the answers for both questions are pretty obvious, right?

38. Message 038 From Victim Victim Date 2/9/2021, 12:13:36 PM

    I know that everyone wants money whether it's you or me or anyone else this life runs on money. Without money no one can survive

39. Message 039 From Victim Victim Date 2/9/2021, 12:15:16 PM

    But do you think is this good business anyone can do it very easily because I talk to other people's they always said that ransomware guys earns lots of money. After wannacry cyber industry is changed

40. Message 040 From Conti Actor / other Date 2/9/2021, 12:27:44 PM

    I cannot provide any non-speculative answer to this question cause it's connected to an ongoing business enterprise. For now it seems to me like I am giving a public interview and as I have already told - we have no interest in spreading our position or opinion. Although I can provide you with some personal view of the situation after the payment is received and I become confident on whom I am speaking to.

41. Message 041 From Victim Victim Date 2/9/2021, 12:37:35 PM

    Ok no worries I understand

42. Message 042 From Conti Actor / other Date 2/9/2021, 5:02:10 PM

    I have to go offline for a while, let me know if you succeed with the payment. Seems like the bitcoin pools are feeling better based on the fact that we've managed to make several transactions today. All the provided wallets will be valid for the next 24 hours so you can choose any of them.

43. Message 043 From Conti Actor / other Date 2/10/2021, 10:11:21 AM

    Any success with the payment?