lockbit3.0 — 36

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Lockbit3.0 Actor / other Date 2024-12-23 10:56:21

   You can attach a few files for test decryption by packing them into an archive with zip, rar, tar, 7zip, 7z, tar.gz extensions of no more than 10 megabytes using the attach button directly in the chat.\r\n\r\nIf your archive weighs more than 10 megabytes, please use our file sharing service.\r\nhttp://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion\r\nhttp://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion\r\nhttp://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion\r\nFor security reasons we do not click on other links you send in chat.\r\nPlease wait for a reply, sometimes it takes several hours due to possible time zone differences.

2. Message 002 From Victim Victim Date 2024-12-23 10:57:33

   hello sir, can you help me what you need to decrypt my files?

3. Message 003 From Victim Victim Date 2024-12-23 10:58:55

   [redacted].pdf.usKv553SJ this is a sample file

4. Message 004 From Lockbit3.0 Actor / other Date 2024-12-23 11:31:23

   You can attach a few files for test decryption by packing them into an archive with zip, rar, tar, 7zip, 7z, tar.gz extensions of no more than 10 megabytes using the attach button directly in the chat.\n\nIf your archive weighs more than 10 megabytes, please use our file sharing service.\nhttp://lockbitfss2w7co3ij6am6wox4xcurtgwukunx3yubcoe5cbxiqakxqd.onion\nhttp://lockbitfsvf75glg226he5inkfgtuoakt4vgfhd7nfgghx5kwz5zo3ad.onion\nhttp://lockbitfskq2fxclyfrop5yizyxpzu65w7pphsgthawcyb4gd27x62id.onion

5. Message 006 From Victim Victim Date 2024-12-23 13:10:53

   could you please how much it will cost to recover my files because we need to know the costs involved.

6. Message 007 From Lockbit3.0 Actor / other Date 2024-12-23 14:50:20

   wait, tech support will send your test files

7. Message 008 From Lockbit3.0 Actor / other Date 2024-12-23 14:51:56

   price decrypt 80k in bitcoin, for all hosts and files

8. Message 009 From Victim Victim Date 2024-12-23 15:47:11

   sir this amount is very high to be paid. We would like to work with you because it will take much time to recover our infrastructure. So some questions from our side \n1. Can you please provide a generous discount so it\'s easier for us to consider your solution?\n2. How fast the recovery process will take if we work with you?

9. Message 010 From Lockbit3.0 Actor / other Date 2024-12-23 16:08:06

   we can\'t offer you a discount

10. Message 011 From Lockbit3.0 Actor / other Date 2024-12-23 16:12:12

    if you pay quickly and restore the infostructure on the same day

11. Message 012 From Lockbit3.0 Actor / other Date 2024-12-23 16:14:28

    I saw your financial report, our price is not big for you

12. Message 014 From Victim Victim Date 2024-12-23 16:38:16

    Thank you for the file.\nIt\'s been a very hard year for our company, also as you know we are in Greece and since 2010 it\'s been very tough times for businesses. And the end of the year is always very hard financially with cashflows.\n\nThat\'s why i am asking for your understanding in price, so I can make an easier decision for my manager to decide.\nPlease if you can convince your own management to consider a generous discount it will help us in our decision with positive result. \nFrom our side we want our files faster and without loses than the options we have now. \nIt seems that you can provide this service from the proof you sent.\nIt would be nice if we can find an agreement on a price we can pay so we can pay you.\nRight now the amount you said is far beyond our real financial capability so we cannot consider this an option.

13. Message 015 From Lockbit3.0 Actor / other Date 2024-12-23 16:46:36

    ok, we can do a 20% discount

14. Message 016 From Victim Victim Date 2024-12-23 17:14:17

    First of all thank you for your understanding and the discount you provided. \nI appreciate your help on this. \nBut still we are very far away from what we can really pay. \nStill the amount you mentioned after the discount is very hard to find in cash.\nWe need to take some serious IT decisions tomorrow as most consultants advised us to format and start from latest offline files which will take several days.\nSo please if you can give us a more grounded financial proposal do so since the purpose here is to see if we can use your services.

15. Message 017 From Lockbit3.0 Actor / other Date 2024-12-23 17:19:57

    I don\'t care whether you pay me or not, there will be no more talk about discounts

16. Message 018 From Lockbit3.0 Actor / other Date 2024-12-23 17:25:20

    If you don\'t make a decision, the price will be 2x tomorrow.

17. Message 019 From Victim Victim Date 2024-12-23 17:29:26

    Please don\'t misunderstand the interest to find a way to pay you with insult. This was not my point. I respect you are talking with us right now and understanding our side. I just want to make it work for our company based on our limitations in cashflow in the end of the year. I know that you don\'t care about us. You attacked us after all. I understand that it\'s just business for you. Some pay, some don\'t. We want us to both benefit from this incident. We gain knowledge and you gain money. But we wanted to get an amount that we can be able to pay you realistically. We are not here to play either. Unfortunately if your purpose is to raise the price there is no point of discussing any more. Even if we find the correct amount we can pay, we will need at least 7 working days to pay you. Regulations are hard with this kind of transactions.

18. Message 020 From Lockbit3.0 Actor / other Date 2024-12-23 17:35:39

    the price will be 60k your decision to pay or not.

19. Message 021 From Victim Victim Date 2024-12-23 17:56:21

    Is there a way to recover 2-3 computers with 15k and get a partial service from your side? So we can see the quality of your service that is valid and then during next year purchase some more bundle of computers? I am just exploring options here to help our operations based on our cashflows.

20. Message 022 From Lockbit3.0 Actor / other Date 2024-12-23 17:58:44

    no, the decryptor will be available for all your files with the extension

21. Message 023 From Victim Victim Date 2024-12-24 16:32:59

    Hello sir, could you please accept the price of 30000$ before the end of the year so we can catch up with the processes to pay you in full for the full service you provide? It will take a lot of effort for us to return to normality so we can see this as a successful penetration test from your team and justify the expenses we need to pay to your work. Mention we need some days to manage to pay this huge amount of money so we need your understanding on this.

22. Message 024 From Lockbit3.0 Actor / other Date 2024-12-24 18:04:24

    you can pay 50k, but the offer will be available for a some days\nif you can\'t pay on the weekend, I\'ll refund price.

23. Message 025 From Victim Victim Date 2024-12-24 21:03:25

    Please stay with me on this. Even if we find a way to work together, the amount is too big to find it these days. Last two years it\'s been very hard for us and it\'s the end of the year. We are trying to find whatever resources are available in cash and let you know. In the following two days we will have a better picture on our financials. We need at least 6-7 days to find 30k, we will need more to get more money to you. There is very limited cashflow in the end of the year which makes things very hard. Let me see what we can do and get back to you. I will try my best, because we want this to finish soon. There is big spending in the end of the year and limited cash receivable. Need more time to see what we can do for you.

24. Message 026 From Victim Victim Date 2024-12-27 10:16:45

    hello sir, can you please let us know how we can do the payment?

25. Message 027 From Lockbit3.0 Actor / other Date 2024-12-27 12:54:26

    hello, btc wallet: [redacted]

26. Message 028 From Victim Victim Date 2024-12-27 13:08:42

    We managed to gather this amount you requested. It\'s been very hard. \n\nPlease let us know if you accept the following.\nWhen we pay 50.000$ USD to this wallet [redacted] you will keep your promise to:\n1. Give us a tool to decrypt all our files in ESXi and all computers affected and we will decrypt today\n2. Provide technical support from your side in case something doesn\'t work\n3. Promise you will never attack us in the future\n4. Help us understand how we can prevent such incidents again in the future and explain how you managed to get in our infrastructure along with technical details.\n\nWhen we have your replies and confirmation for the above we proceed in the payment.

27. Message 029 From Lockbit3.0 Actor / other Date 2024-12-27 13:18:22

    1. there will be no problems with the decryptor,for esxi and all windows files\n2. you will need to disable your av and just run the.exe decryptor\n3. it could be someone else\n4. you know your pass P@ssw0rd

28. Message 030 From Victim Victim Date 2024-12-27 13:20:28

    if we pay in the next hour when we will get decryptor?

29. Message 031 From Lockbit3.0 Actor / other Date 2024-12-27 13:24:37

    i make a request to tech support, it can take from an hour to five hours

30. Message 032 From Victim Victim Date 2024-12-27 13:26:16

    shall we sent 10$ just you to confirm and then send the rest 49990?

31. Message 033 From Lockbit3.0 Actor / other Date 2024-12-27 13:27:13

    ok

32. Message 034 From Victim Victim Date 2024-12-27 13:31:24

    https://mempool.space/tx/[redacted] can you confirm you received this?

33. Message 035 From Lockbit3.0 Actor / other Date 2024-12-27 13:34:48

    yes 0.00010389

34. Message 036 From Victim Victim Date 2024-12-27 14:12:01

    bitcoin seller sais you got the money. Please confirm\nhttps://mempool.space/tx/[redacted]

35. Message 037 From Lockbit3.0 Actor / other Date 2024-12-27 14:19:47

    is ok, thank you

36. Message 038 From Lockbit3.0 Actor / other Date 2024-12-27 14:24:03

    wait pls, tech support will drop decryptor here

37. Message 039 From Victim Victim Date 2024-12-27 14:24:15

    ok

38. Message 041 From Victim Victim Date 2024-12-27 14:32:37

    this is not decryptor

39. Message 042 From Lockbit3.0 Actor / other Date 2024-12-27 14:37:36

    yes, decryptor we wait

40. Message 044 From Victim Victim Date 2024-12-27 15:55:19

    What about esxi?

41. Message 045 From Lockbit3.0 Actor / other Date 2024-12-27 15:55:52

    Give me readme file from esxi

42. Message 046 From Victim Victim Date 2024-12-27 15:57:26

    ok give me 5 minutes

43. Message 048 From Victim Victim Date 2024-12-27 16:30:50

    the VMDK files cannot be decrypter with the.exe decryptor. could you please send decryptor for VMDK in ESxi based on the txt file i sent you 15 minutes ago?

44. Message 049 From Lockbit3.0 Actor / other Date 2024-12-27 16:31:33

    yes

45. Message 050 From Lockbit3.0 Actor / other Date 2024-12-27 16:31:38

    wait 5 minutes

46. Message 052 From Victim Victim Date 2024-12-27 16:40:14

    is there a way to decrypt VMDK files on windows? i have a copy of them and the windows decryptor doesn\'t work with them

47. Message 053 From Lockbit3.0 Actor / other Date 2024-12-27 16:40:31

    only linux

48. Message 054 From Victim Victim Date 2024-12-27 16:42:05

    please provide command line instructions to run linux

49. Message 055 From Victim Victim Date 2024-12-27 16:55:40

    1. Could you please tell me which commands to run on ESXi step by step in order to decrypt all files?\n2. Is there a chance that something goes wrong when i execute this decrypt_ESXI_X64 command on ESXi? Do i lose all the VMDK files in the server?