extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

lockbit3.0 — 154

Date not recorded

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 137 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
lockbit3.0
Record date
Date not recorded
Messages
137
Participants
Lockbit3.0, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Lockbit3.0 Actor / other Date

    You can attach a few files for test decryption by packing them into an archive with zip, rar, tar, 7zip, 7z, tar.gz extensions of no more than 10 megabytes using the attach button directly in the chat.\r\n\r\nIf your archive weighs more than 10 megabytes, please use our file sharing service.\r\nhttp://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion\r\nhttp://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion\r\nhttp://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion\r\nFor security reasons we do not click on other links you send in chat.\r\nPlease wait for a reply, sometimes it takes several hours due to possible time zone differences.

  2. Message 002 From Victim Victim Date

    Hi Lockbit, this is [redacted] and saw the post and may we ask to get the directory listing of all the files that you have. May we ask for more time so we can inform our stakeholders for them to assess and consider our next move? Thank you for understanding.\n

  3. Message 003 From Lockbit3.0 Actor / other Date

    http://lockbit6vhrjaqzsdj6pqalyideigxv4xycfeyunpx35znogiwmojnid.onion/secret/[redacted]

  4. Message 004 From Lockbit3.0 Actor / other Date

    you can download all the files that we have and see for yourself

  5. Message 005 From Lockbit3.0 Actor / other Date

    the blog was taken down for a while

  6. Message 006 From Victim Victim Date

    Thank you for your consideration.

  7. Message 007 From Victim Victim Date

    Good day, may we negotiate the amount you have in mind and what in turn would be Lockbit\'s end of the bargain.

  8. Message 008 From Lockbit3.0 Actor / other Date

    120k$ in bitcoin

  9. Message 009 From Lockbit3.0 Actor / other Date

    After payment, 100% of your files will be securely deleted and our team won\'t bother you again. You can trust us by reading about us on the global internet. We value our reputation

  10. Message 010 From Lockbit3.0 Actor / other Date

    our deals run on a regular basis, client want to solve the problem before first posting information on the blog

  11. Message 011 From Victim Victim Date

    Dear Lockbit, may we state that last year was the only time we were profitable and we only earned $200k. We have also notified the regulators and our clients as well as required by law since the encryption last January 25 caused a major outage. That said, we were able to restore operation with some backups, albeit with some data loss therefore decryption wont really be necessary. Please give as an amount that we can get back to our leaders to be considered.\n

  12. Message 012 From Lockbit3.0 Actor / other Date

    maybe we can lower the amount, but not by much.

  13. Message 013 From Lockbit3.0 Actor / other Date

    in the process of working with you, we thought about 100k.

  14. Message 014 From Lockbit3.0 Actor / other Date

    our principles have become worth more than money. However, a discount can be negotiated.

  15. Message 015 From Victim Victim Date

    Thank you for your consideration. 100k is still very steep for us as its half of our revenue which will be negated with the damage caused by the outage. May we respectfully ask to please significantly bring it down since we are only technically be requesting for the deletion of the data and we do understand that this is just business for you.\n

  16. Message 016 From Lockbit3.0 Actor / other Date

    I don\'t know how much you\'d be willing to pay.

  17. Message 017 From Lockbit3.0 Actor / other Date

    but I know it would be a big problems to you if we released your data in blog.

  18. Message 018 From Lockbit3.0 Actor / other Date

    They often say they\'ve had a bad year, but they\'ll still have to pay.

  19. Message 019 From Lockbit3.0 Actor / other Date

    If I give a price now, it will be the last one.

  20. Message 020 From Victim Victim Date

    We understand, and we actually had a good year last year since thats the first time we were positive. But this incident wiped it off all away and will be spending more in recovery. Also, the directors are there just for name as a favor and add credibility which by the way is now in shambles, but they dont really contribute, otherwise they would have sent their army of IT to help us recover. I am looking at 10-20K to comeback to the heads and this will be coming from our own personal funds. While there will be some issues on publishing this, as we mentioned, we have already notified the clients and regulators about this breach.

  21. Message 021 From Lockbit3.0 Actor / other Date

    by the way, you downloaded your backup files, which will help you as well.

  22. Message 022 From Lockbit3.0 Actor / other Date

    20k is not possible and 50k is also not possible, companies much smaller than you pay us such amounts

  23. Message 023 From Lockbit3.0 Actor / other Date

    We are not paid from IT team, they do not have that kind of money. We are paid by the heads of the companies

  24. Message 024 From Lockbit3.0 Actor / other Date

    we don\'t need from yours own personal funds

  25. Message 025 From Lockbit3.0 Actor / other Date

    we can\'t agree on this

  26. Message 026 From Lockbit3.0 Actor / other Date

    we were already aiming to publish you, you may have noticed by the posting time of only 1 day.

  27. Message 027 From Lockbit3.0 Actor / other Date

    you are lucky that you reacted quickly, we did not expect this

  28. Message 028 From Lockbit3.0 Actor / other Date

    even though there was a warning on viber

  29. Message 029 From Lockbit3.0 Actor / other Date

    why didn\'t you react immediately

  30. Message 030 From Lockbit3.0 Actor / other Date

    it\'s your fault

  31. Message 031 From Lockbit3.0 Actor / other Date

    I consulted and asked for another discount for you, our price will be 70k

  32. Message 032 From Lockbit3.0 Actor / other Date

    and we will not rush you to pay

  33. Message 033 From Lockbit3.0 Actor / other Date

    your office will allow you to pay that amount

  34. Message 034 From Victim Victim Date

    Thank you for your concern and consideration, yes this funds will not be coming from IT. But we only have one owner, as we are a small private company, and he will have to cover everything. We were unsure of the viber message, but here we are. We will come back to you if we can convince him to pay 50k as this is still big for one person.

  35. Message 035 From Lockbit3.0 Actor / other Date

    in the message in Viber there was a link to your archive to make sure

  36. Message 036 From Lockbit3.0 Actor / other Date

    our price was 70k you write about 50k, let me talk to the team and agree on 60k for everyone

  37. Message 037 From Victim Victim Date

    Ok, let us know. Thank you.\n

  38. Message 038 From Lockbit3.0 Actor / other Date

    we agree to 60k, decision is yours

  39. Message 039 From Victim Victim Date

    Will relay this and come back with a decision tomorrow morning as its 1am here. Do you have a code name or nickname so we know we are talking to the same customer support tomorrow?

  40. Message 040 From Lockbit3.0 Actor / other Date

    ok, on your time 16-17 o clock, I\'ll be online in this chat, possibly earlier

  41. Message 041 From Victim Victim Date

    Ok, thank you for your patience.

  42. Message 042 From Lockbit3.0 Actor / other Date

    Thank you too, good luck.

  43. Message 043 From Victim Victim Date

    Good day Lockbit, we have met and we have come up with our final offer of 30k. Please do consider that we are only asking for the deletion of the data as we have already notified the regulators and clients about the breach as mandated by law. So this is just to minimize exposure so we can concentrate in the restoration activities. Hoping for you kind consideration.

  44. Message 044 From Lockbit3.0 Actor / other Date

    you know, if we publish your data, you will lose more than 30k

  45. Message 045 From Lockbit3.0 Actor / other Date

    they will also end up with your competitors, and you will be on the verge of closing down

  46. Message 046 From Lockbit3.0 Actor / other Date

    If your directors wants to get off easy, it won\'t work

  47. Message 047 From Lockbit3.0 Actor / other Date

    30k doesn\'t mean anything to us.

  48. Message 048 From Lockbit3.0 Actor / other Date

    We are waiting for another offer from you

  49. Message 049 From Lockbit3.0 Actor / other Date

    our last successful data deal that we had was for 500k, clients pay well for their data, not for encryption

  50. Message 050 From Lockbit3.0 Actor / other Date

    we made concessions to you, but you\'re upsetting us with your offer.

  51. Message 051 From Victim Victim Date

    Let me get back to you.

  52. Message 052 From Victim Victim Date

    Hi Lockbit, I\'ve talked to our heads and most of them are against of paying at all. We don\'t know much about your business and the heads are insistent that you would go against your word and sell the data nonetheless. We\'ve been transparent with our regulators and clients and have been working days and nights non-stop for restoration activities. And now, we just want to minimize the damage and hoping for peaceful restoration activities by deleting the data that you have. \n\nThe heads don\'t want to pay at all but I\'ve told them that you value your reputation as you said and have managed to convince them to pay 40k for the destruction of data. Kindly consider this offer.

  53. Message 053 From Lockbit3.0 Actor / other Date

    We keep our word! only one person and me has your files, after your payment 40k, they will be securely removed by the program [redacted]

  54. Message 054 From Lockbit3.0 Actor / other Date

    we were going to agree with you for 50k, but okay, I personally agree with you on 40k

  55. Message 055 From Victim Victim Date

    Thank you for consideration. Do we have a deal at 40k?

  56. Message 056 From Lockbit3.0 Actor / other Date

    you need to buy bitcoin, write to me when you are ready and I will give you a wallet

  57. Message 057 From Lockbit3.0 Actor / other Date

    40k$ in bitcoin

  58. Message 058 From Victim Victim Date

    I will relay the agreement and will get back to you tomorrow same time. Thank you for your consideration.

  59. Message 059 From Lockbit3.0 Actor / other Date

    ok

  60. Message 060 From Victim Victim Date

    Good day, we are now preparing the funds and should be ready by Monday. We need help in converting to bitcoin. Would you be able to point us to how any of your previous clients from the Philippines is able to acquire bitcoins for payment?

  61. Message 061 From Lockbit3.0 Actor / other Date

    Hello, I can only give you a our bitcoin wallet

  62. Message 062 From Lockbit3.0 Actor / other Date

    http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/buybitcoin#mirrors

  63. Message 063 From Lockbit3.0 Actor / other Date

    here you can see where to buy bitcoin

  64. Message 064 From Victim Victim Date

    Thank you and will check this out.

  65. Message 065 From Victim Victim Date

    Good day Lockbit, we are consolidating the funds and should be completed within the week. We have candidates on where to purchase bitcoin locally with minimal paperworks and will be talking to them on Thursday.

  66. Message 066 From Lockbit3.0 Actor / other Date

    Good day, please don\'t delay for long time

  67. Message 067 From Victim Victim Date

    Rest assured we are doing our best to process the funds immediately. Thank you for your patience.

  68. Message 068 From Lockbit3.0 Actor / other Date

    fine, I\'m not hurry you

  69. Message 069 From Lockbit3.0 Actor / other Date

    I\'m waiting for you on Thursday

  70. Message 070 From Victim Victim Date

    Yes, will give update by then. We are really trying to get the money out and buy crypto but it\'s harder when we want less paper trail. This is also the first time we are doing this so thank you for your patience.

  71. Message 071 From Victim Victim Date

    Good day Lockbit, we\'re expecting to get the cash out by Saturday or Monday then we can start purchasing the coins next week. Will update you again on Monday\n

  72. Message 072 From Lockbit3.0 Actor / other Date

    Thanks, allright

  73. Message 073 From Victim Victim Date

    Good day Lockbit, \n\nWe have finally acquired the funds and is now in the process of buying bitcoin. We are evaluating possible sources of bitcoins this week without KYC then it might take some time since we have to split the purchase under $8,000 to avoid being flagged. We\'ll give you our wallet address once we start purchasing so you could monitor then we\'ll do an initial test transfer to you after.\n\nWe could send you a picture for proof of our activities with your required instructions if needed. Thank you for understanding.

  74. Message 074 From Lockbit3.0 Actor / other Date

    Hello, proofs not need, we\'ll wait

  75. Message 075 From Victim Victim Date

    Thank you for the trust. One of us got a call from an unknown number in Lithuania, please give us time to purchase bitcoins.

  76. Message 076 From Lockbit3.0 Actor / other Date

    I don\'t know who called, not us, we just waiting

  77. Message 077 From Lockbit3.0 Actor / other Date

    how are you doing with buying bitcoin?

  78. Message 078 From Lockbit3.0 Actor / other Date

    how long do you think it will take?

  79. Message 079 From Victim Victim Date

    We will be splitting the purchase to avoid tripping regulatory limits, so once we have a seller, the estimate time is 2 weeks.

  80. Message 080 From Lockbit3.0 Actor / other Date

    we have never waited so long, and the amount is not large

  81. Message 081 From Lockbit3.0 Actor / other Date

    this is suspicious, why are you delaying time

  82. Message 082 From Lockbit3.0 Actor / other Date

    anyone can register a personal account on the exchange and buy bitcoin in the moment

  83. Message 083 From Lockbit3.0 Actor / other Date

    very long and it becomes strange

  84. Message 084 From Victim Victim Date

    Apologies for the wait. We are doing precautionary measures to minimize our trail of buying bitcoins and paying for the ransom.

  85. Message 085 From Victim Victim Date

    We can send you the picture of the cash with a marker you will request as proof. But we can\'t deposit this to a bank and use that account to buy crypto without paper trail. Hope you understand

  86. Message 086 From Lockbit3.0 Actor / other Date

    you can put cash on a card of a person not from the company, and he will be able to buy bitcoin in one click on a popular exchange, for example, binance.com

  87. Message 087 From Lockbit3.0 Actor / other Date

    do not use personal exchangers, they will have a bad rate bitcoin and they may scam you

  88. Message 088 From Victim Victim Date

    Yes it was an option before but Binance is banned in the Philippines and can\'t get them from the app stores or create accounts. We are talking to 2 possible sellers. Please be patient, this is the first time we are doing this kind of transaction. We do have good progress.

  89. Message 089 From Lockbit3.0 Actor / other Date

    ok, no problem

  90. Message 090 From Victim Victim Date

    Good day Lockbit, we already got the crypto this morning. Could we do the transaction within today since the market is going down. Would like to conduct test transfer first before giving the full amount.

  91. Message 091 From Lockbit3.0 Actor / other Date

    Hello, great

  92. Message 092 From Lockbit3.0 Actor / other Date

    [redacted]

  93. Message 093 From Lockbit3.0 Actor / other Date

    this is a btc wallet, you can send test transfer

  94. Message 094 From Victim Victim Date

    Alright, will now start sending test transfer payment of $100.

  95. Message 095 From Victim Victim Date

    We would like to mention that we bought 40k USD worth of bitcoin this morning but with the volatility and transaction fees it will be less. Hope this is okay with you as we want to complete the transaction. Rest assured that we will give you all the btc we were able to acquire.

  96. Message 096 From Lockbit3.0 Actor / other Date

    ok

  97. Message 097 From Victim Victim Date

    Test transfer of $100 worth of btc has been sent to your btc address and is now PENDING in status. Please confirm once received. Thank you.

  98. Message 098 From Victim Victim Date

    The status of the test transfer is now COMPLETED, could you please check on your end?

  99. Message 099 From Lockbit3.0 Actor / other Date

    +

  100. Message 100 From Lockbit3.0 Actor / other Date

    test transfer came

  101. Message 101 From Lockbit3.0 Actor / other Date

    0.00124505

  102. Message 102 From Lockbit3.0 Actor / other Date

    you can send all amout

  103. Message 103 From Victim Victim Date

    We would like to split the next transactions in case we make a mistake. We will next transfer 20k usd in btc first and then the rest of the amount. We hope you understand and this is okay with you.

  104. Message 104 From Lockbit3.0 Actor / other Date

    yes of course, ok

  105. Message 105 From Victim Victim Date

    Split transfer of $20k worth of btc has been sent to your btc address and is now PENDING in status. Please confirm once received. Thank you.

  106. Message 106 From Victim Victim Date

    Could you help me a bit, may I ask the details of how you got access to our network? Did you exploit our public web app server or phish our users?

  107. Message 107 From Lockbit3.0 Actor / other Date

    is fine, 20k confirm

  108. Message 108 From Lockbit3.0 Actor / other Date

    remove the admin from the domain who controls infostructure, no matter what antivirus you install, the domain will always be vulnerable

  109. Message 109 From Lockbit3.0 Actor / other Date

    got to you through phishing, but I don\'t remember the first host

  110. Message 110 From Lockbit3.0 Actor / other Date

    and you had very easy passwords

  111. Message 111 From Lockbit3.0 Actor / other Date

    I followed the work [redacted], and waited for him to log into Google Backup

  112. Message 112 From Lockbit3.0 Actor / other Date

    about a month

  113. Message 113 From Lockbit3.0 Actor / other Date

    sorry can you transfer the rest, i\'m very late now

  114. Message 114 From Lockbit3.0 Actor / other Date

    I need to go and I\'ll be here in a few hours

  115. Message 115 From Lockbit3.0 Actor / other Date

    Within 24 hours your archive will be deleted from the blog, also i use software [redacted] delete archive from physical pc\nI\'ll send you a screenshot, you don\'t have to worry, we won\'t bother you anymore and your data will be securely deleted

  116. Message 116 From Victim Victim Date

    Sorry just wanted to clarify does this mean you were able to get glen moyo\'s account through phishing as well?

  117. Message 117 From Victim Victim Date

    We are now sending the rest of the payment. Thank you for your response.

  118. Message 118 From Victim Victim Date

    Rest of the payment has been sent to your btc address and is now PENDING in status

  119. Message 119 From Lockbit3.0 Actor / other Date

    we got into the network through a manager with user priv, and dump ntlm local admin access on all the hosts in the domain.

  120. Message 120 From Lockbit3.0 Actor / other Date

    then we found the admin in the domain

  121. Message 121 From Lockbit3.0 Actor / other Date

    [login]:[password]

  122. Message 122 From Lockbit3.0 Actor / other Date

    You have a Kaspersky server in your domain, remove it

  123. Message 123 From Lockbit3.0 Actor / other Date

    thank you, the full amount has been received

  124. Message 124 From Lockbit3.0 Actor / other Date

    I\'ll be back a little later and get to work on deleting your data

  125. Message 125 From Lockbit3.0 Actor / other Date

    You can also ask what you need, I will answer

  126. Message 126 From Lockbit3.0 Actor / other Date

    now sorry me, I need to go

  127. Message 127 From Victim Victim Date

    Thank you and apologies for the questions, on the domain, could you expound a bit as we didn\'t have domain configured yet at the time of the incident.

  128. Message 128 From Lockbit3.0 Actor / other Date

    Let me come back and of course I will answer

  129. Message 129 From Victim Victim Date

    It\'s alright. Thank you. We\'ll get back on this chat to check in on the deletion as well.

  130. Message 130 From Lockbit3.0 Actor / other Date

    I\'m expected, I have to leave now.

  131. Message 131 From Lockbit3.0 Actor / other Date

    of course i will be here

  132. Message 132 From Lockbit3.0 Actor / other Date

    thanks

  133. Message 133 From Lockbit3.0 Actor / other Date

    Your data was deleted

  134. Message 134 From Lockbit3.0 Actor / other Date

    http://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion/r/A92AhVtry4#NnaQzPn9YB18sGhEcJO0J/MxOBh377D8mD2tssXo30A=

  135. Message 135 From Lockbit3.0 Actor / other Date

    proof

  136. Message 136 From Victim Victim Date

    Thank you for this. May I ask another question, we\'ve read from reports that you often use Anydesk in your attacks, can you explain how it is relevant to you?

  137. Message 137 From Lockbit3.0 Actor / other Date

    Hello, you had anydesk installed on many hosts, we just used it to get back