extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Conti — 20201230

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 146 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Conti
Record date
Dec 30, 2020
Messages
146
Participants
Conti, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    [redacted]: Help?

  2. Message 002 From Conti Actor / other Date

    Support: Hello

  3. Message 003 From Conti Actor / other Date

    Support: Are you ready to negotiate?

  4. Message 004 From Conti Actor / other Date

    Support: As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website https://continews.best/ (TOR mirror: http://fylszpcqfel7joif.onion). The recovery price is $8500000 (302.5 BTC). This initial offer is based on the details about your revenue and internal financial documents we currently have access to. If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published, all the backdoors will be removed from your network and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch.

  5. Message 005 From Victim Victim Date

    [redacted]: That's a crazy price. How do we even know if this will work?

  6. Message 006 From Conti Actor / other Date

    Support: You can send 2 files for decrypt. Its free.

  7. Message 007 From Conti Actor / other Date

    Support: In addition, we have stolen more than 1 terabyte of information from your network.

  8. Message 008 From Victim Victim Date

    [redacted]: We have a lot of questions. Maybe you've got the wrong price because we have no idea what internal financial documents show that we can pay $8,500,000.

  9. Message 009 From Conti Actor / other Date

    Support:  Hours and Revenue analysis November 2020 YTD (2).xlsx [ 52kB ]

  10. Message 010 From Victim Victim Date

    [redacted]: I'm not in finance but those look like revenue numbers, not profits. Can you share the files you've taken so that our team can verify?

  11. Message 011 From Conti Actor / other Date

    Support: Yes. Please wait.

  12. Message 012 From Victim Victim Date

    [redacted]: Thanks. I should have 2 files for you shortly.

  13. Message 013 From Conti Actor / other Date

    Support:  list_firstpart.zip [ 5MB ]

  14. Message 014 From Victim Victim Date

    [redacted]: What's this?

  15. Message 015 From Conti Actor / other Date

    Support: Listing of the first part of the stolen information

  16. Message 016 From Victim Victim Date

    [redacted]: Will we get more parts later?

  17. Message 017 From Conti Actor / other Date

    Support: Yes, we are unpacking a terabyte. It will take a lot of time. You can select any file from the listing and we will discard it as proof that we have these files.

  18. Message 018 From Victim Victim Date

    [redacted]: Ok please let us know once it has been unpacked. It will be important to get the full listing

  19. Message 019 From Victim Victim Date

    [redacted]:  [redacted]-EMEA.xml.[redacted] [ 3kB ]

  20. Message 020 From Victim Victim Date

    [redacted]: Can you decrypt this?

  21. Message 021 From Conti Actor / other Date

    Support: I have sent your file to the technical department. Wait.

  22. Message 022 From Conti Actor / other Date

    Support:  [redacted]-EMEA.xml [ 2kB ]

  23. Message 023 From Victim Victim Date

    [redacted]: We're going to review all these files.Any update on the 1 TB?

  24. Message 024 From Conti Actor / other Date

    Support: Will upload the file listing as soon as it's ready.

  25. Message 025 From Victim Victim Date

    [redacted]: Ok we'll be here. Thanks

  26. Message 026 From Conti Actor / other Date

    Support: 25 % ready. This is a very slow process. Wait.

  27. Message 027 From Conti Actor / other Date

    Support: It will take a few days

  28. Message 028 From Conti Actor / other Date

    Support: You can choose ANY file from the listing above and we will discard it as proof

  29. Message 029 From Victim Victim Date

    [redacted]: We'll work on that. Offices are closed the next few days but we'll be in touch. Ok?

  30. Message 030 From Victim Victim Date

    [redacted]: This is our priority

  31. Message 031 From Conti Actor / other Date

    Support: Ok, just keep us updated on your progress.

  32. Message 032 From Conti Actor / other Date

    Support: 50% Ready

  33. Message 033 From Conti Actor / other Date

    Support: 70% Ready

  34. Message 034 From Victim Victim Date

    [redacted]: Thanks. We're still here

  35. Message 035 From Victim Victim Date

    [redacted]: While you're pulling the file tree, can you send us this file? 05/07/2020 02:55 PM 106,393 [redacted] - Draft 2020 05 06 v2.docx

  36. Message 036 From Conti Actor / other Date

    Support: Yes, will upload soon

  37. Message 037 From Conti Actor / other Date

    Support:  [redacted]---draft-2020-05-06-v2.docx [ 104kB ]

  38. Message 038 From Conti Actor / other Date

    Support: %90 ready

  39. Message 039 From Victim Victim Date

    [redacted]: Thanks, still here and checking in.

  40. Message 040 From Conti Actor / other Date

    Support: 100% ready. Wait listing

  41. Message 041 From Conti Actor / other Date

    Support:  listing_1tb.zip [ 9.2MB ]

  42. Message 042 From Conti Actor / other Date

    Support: You can choose ANY file from the listing above and we will discard it as proof

  43. Message 043 From Victim Victim Date

    [redacted]: Thanks. So this is a directory of every single file you've taken from our network?

  44. Message 044 From Conti Actor / other Date

    Support: yes

  45. Message 045 From Conti Actor / other Date

    Support: total of data more 1tb

  46. Message 046 From Conti Actor / other Date

    Support: so, what other questions do you have?

  47. Message 047 From Victim Victim Date

    [redacted]: Thanks. We are looking now

  48. Message 048 From Conti Actor / other Date

    Support: so?

  49. Message 049 From Victim Victim Date

    [redacted]: This is a lot of data to review. How did you get these files off our network?

  50. Message 050 From Conti Actor / other Date

    Support: Packing data into an archive provides compression up to 95%

  51. Message 051 From Conti Actor / other Date

    Support: After the deal is concluded, we will give recommendations on how to prevent this.

  52. Message 052 From Conti Actor / other Date

    Support: I propose to return to the discussion of the agreement

  53. Message 053 From Conti Actor / other Date

    Support: After the conclusion of the agreement, we overwrite the data

  54. Message 054 From Victim Victim Date

    [redacted]: Yes, we want to discuss the agreement. $8,500,000 is a lot of money. We're just trying to see all the details because that is still an unexpected amount.

  55. Message 055 From Victim Victim Date

    [redacted]: Even if we had that much money, how do we know you won't just take the money and resell the data?

  56. Message 056 From Conti Actor / other Date

    Support: We will show the cleaning logs

  57. Message 057 From Conti Actor / other Date

    Support: This price is indicated for restoring ALL data in your network and deleting data on our servers

  58. Message 058 From Conti Actor / other Date

    Support: We will give a decryptor and you will restore all the work

  59. Message 059 From Conti Actor / other Date

    Support: We value our reputation and never leak any data after the deal is closed

  60. Message 060 From Victim Victim Date

    [redacted]: Alright, so we are thinking this through now. I will get back to you soon, alright?

  61. Message 061 From Conti Actor / other Date

    Support: Ok, waiting.

  62. Message 062 From Victim Victim Date

    [redacted]: We're trying to get answers on our end. Thanks for waiting

  63. Message 063 From Conti Actor / other Date

    Support: Ok waiting

  64. Message 064 From Conti Actor / other Date

    Support: If you have any questions - we can help you But the sooner you conclude an agreement, the sooner you will resume work and will no longer suffer losses due to this situation.

  65. Message 065 From Victim Victim Date

    [redacted]: Can you send this file? 08/03/2020 05:14 PM 13,697 [redacted]_v4 CL.docx

  66. Message 066 From Conti Actor / other Date

    Support: Yes Wait

  67. Message 067 From Conti Actor / other Date

    Support:  [redacted]_v4-cl.docx [ 13kB ]

  68. Message 068 From Victim Victim Date

    [redacted]: Thanks for the quick response

  69. Message 069 From Conti Actor / other Date

    Support: Are you convinced? There is really a lot of your data here

  70. Message 070 From Victim Victim Date

    [redacted]: We certainly see that you have our data. Nothing to hide there

  71. Message 071 From Victim Victim Date

    [redacted]: It's the price that's causing us heartburn...

  72. Message 072 From Conti Actor / other Date

    Support: Publishing data will cause customer churn and you will lose much more. It is more profitable to work with us

  73. Message 073 From Victim Victim Date

    [redacted]: Yes, but how do we pay if we don't have the cash?

  74. Message 074 From Conti Actor / other Date

    Support: There are plenty of ways to get the cash, like insurance or a corporate loan.

  75. Message 075 From Victim Victim Date

    [redacted]: If those were option we would have pulled those levers already!

  76. Message 076 From Conti Actor / other Date

    Support: We are ready to hear your proposal which is based on your abilities, but it should be relevant to the initial offer.

  77. Message 077 From Victim Victim Date

    [redacted]: We are treating this as a data leak, no matter what. However, there is some upside to getting the files deleted (even though there are no assurances). Millions of dollars is excessive for this type of data and we don't have much need for a decryptor. Our proposal is $250,000.

  78. Message 078 From Conti Actor / other Date

    Support: That is way lower than your abilities and not as relevant to our expectations as we thought. Although I will pas your offer to my boss and get back to you.

  79. Message 079 From Victim Victim Date

    [redacted]: Sounds good. Thanks.

  80. Message 080 From Conti Actor / other Date

    Support: We've discussed internally, and taking in consideration the facts that you are trying to work this through and the fact that you don't need the decryption tool I've managed to convince my boss to provide you the huge discount by going down to $2125000 (70% discount). If we close the deal this way we have to intention to sell or publish your data of course.

  81. Message 081 From Victim Victim Date

    [redacted]: We are still far apart but we view this is a positive step. Thank you.

  82. Message 082 From Victim Victim Date

    [redacted]: Can we discuss with our team?

  83. Message 083 From Conti Actor / other Date

    Support: yes

  84. Message 084 From Victim Victim Date

    [redacted]: This reduction is interesting. It's almost end of week here and some of our management wants to discuss. Can we reach out next week?

  85. Message 085 From Conti Actor / other Date

    Support: Yes, sure, let's get back to this on Monday. Just keep us updated on the progress.

  86. Message 086 From Victim Victim Date

    [redacted]: Ok

  87. Message 087 From Victim Victim Date

    [redacted]: We're connecting on this topic later today and tomorrow morning. We may be able to increase the dollar amount.

  88. Message 088 From Conti Actor / other Date

    Support: Ok, will be waiting for further details

  89. Message 089 From Victim Victim Date

    [redacted]: We have reviewed the data and while the files contain company information, they will not cause millions in damage. Even if they did, we'd have to live with that because we are on a tight budget in 2021. However, we think there is some value with your cooperation and we're prepared to pay $400,000 immediately. We can work out the details if you want to make a profit. Otherwise, we may be out of opportunities.

  90. Message 090 From Conti Actor / other Date

    Support: We will discuss internally and get back to you soon.

  91. Message 091 From Victim Victim Date

    [redacted]: great, ok thank you.

  92. Message 092 From Conti Actor / other Date

    Support: We've discussed, despite the fact that my boss considers our last offer reasonable I managed to convince him to review it. He agreed to go down to $600k if the deal will be closed by the end of this week. Once the transfer is made you will be provided with security recommendations on network improvement, breach details, all you files will be completely wiped from our servers once and for all. Also we can upload your files to mega.nz secure share and provide you with full access to it. That's a fair offer and I did everything possible to make it work. Hope you appreciate.

  93. Message 093 From Victim Victim Date

    [redacted]: We do appreciate that but we'll need to discuss since it's more money than what we have at the moment. Before we discuss, can you also confirm that we would receive a decryption tool in addition to the above deliverables?

  94. Message 094 From Conti Actor / other Date

    Support: As I remember you do not need a decryption tool. Am I mistaken? Most of the discount was provided based on the fact that you do not need the decryption.

  95. Message 095 From Victim Victim Date

    [redacted]: There are some files that would save us time. $400,000 is not a small amount.

  96. Message 096 From Conti Actor / other Date

    Support: That is way below our offer. Yes, surely the decryptor would save you some time, and time means money. The $600k offer was for the data we hold. As you must understand we have some experience in negotiations, and you are trying to put us in the position that you think we accept, based on the basic information that is in the the press about usual sum we get. Relying on the press or public opinion is a mistake. About 75% of our deals are never leaked to the public or revealed. We will be waiting for your decision by tomorrow. $600k for the files or something better for full pack.

  97. Message 097 From Victim Victim Date

    [redacted]: Yes, we know you are very experienced. We can sense it. All we're doing is seeing how much money we can spend, and $400,000 is an large sum. If we go down this path, then we certainly want all of the items that are available.

  98. Message 098 From Victim Victim Date

    [redacted]: We've read about you in the press but we have no idea about the usual sum that you get. No one here wants to play games, and that's why we're trying to finalize the deliverables in advance. We want a solution and we assume you want to get paid. But $400,000 is only available if we can get everything. How else can we afford to pay that much?

  99. Message 099 From Conti Actor / other Date

    Support: The $400k is too low anyways. I will talk to my boss and try to get an offer for $600k that will contain the decryptor. Give me few hours.

  100. Message 100 From Victim Victim Date

    [redacted]: Alright - your best offer that includes the decryptor will be taken under very serious consideration. Thank you.

  101. Message 101 From Conti Actor / other Date

    Support: Talked to my boss. When he heard about the decryption tool being needed, at first he was ready to move back to the previous offer or at least move to 1.2mil (x2 from the data offer), but we've decided not too be hard on you and are ready to stay at $750k. Take this to the management and let me know what they decide.

  102. Message 102 From Victim Victim Date

    [redacted]: I appreciate you trying. We have a lot of money set aside for this but $750,000 just won't be possible. If the price was $600,000 then we may have been able to push closer to that. But at $750,000, it is just so far...

  103. Message 103 From Conti Actor / other Date

    Support: We can leave it $600k if the transfer will be done today or tomorrow. The BTC wallet is: [redacted]

  104. Message 104 From Victim Victim Date

    [redacted]: Let me discuss with the team. This is still above our budget but we can try to work towards it quickly. Thanks.

  105. Message 105 From Victim Victim Date

    [redacted]: We took this management and discussed. They were certainly appreciative of you being able to include the decryptor in the $600,000 price. While the price itself is still high for us, we feel more confident in being able to move past this with you. We may be paying more than the value, but want to keep the positivity in our discussions. As a result, we can increase our offer to $450,000 and can begin the transfer soon if you are with us. Thank you.

  106. Message 106 From Conti Actor / other Date

    Support: $600k. take it back.

  107. Message 107 From Conti Actor / other Date

    Support: And the sum will be increased if we will not receive the funds within mentioned time frames.

  108. Message 108 From Victim Victim Date

    [redacted]: Well, increasing the sum is not going to get us any closer. I will get back to you in a bit.

  109. Message 109 From Victim Victim Date

    [redacted]: We had an early morning call. $450,000 is our limit and this is more than what we anticipated paying. We can start the payment process soon if you can agree. Otherwise, this may not be the ending we had hoped for.

  110. Message 110 From Victim Victim Date

    [redacted]: We know you worked hard to make this work and we appreciate it. It's just that we're at our limit.

  111. Message 111 From Conti Actor / other Date

    Support: You still have a little time to conclude an agreement on the terms above. Then the price will increase.

  112. Message 112 From Victim Victim Date

    [redacted]: We have worked day and night to make this work and we understand you're doing the same. If the price goes up then there is no way we can pay. All we ask is for a little help so that we can get the cash in your hands. $450,000 is not a small amount for us.

  113. Message 113 From Conti Actor / other Date

    Support: I'm sorry. I'll talk to the boss today, but I'm afraid he'll stand his ground.

  114. Message 114 From Victim Victim Date

    [redacted]: Thank you. That would be helpful

  115. Message 115 From Victim Victim Date

    [redacted]: Did you talk to your boss today?

  116. Message 116 From Conti Actor / other Date

    Support: Not yet, will update you as soon as he replies.

  117. Message 117 From Conti Actor / other Date

    Support: Ok. $450k. BTC wallet: [redacted]

  118. Message 118 From Victim Victim Date

    [redacted]: Thank you. Can you confirm what we will receive in return of a $450,000 payment?

  119. Message 119 From Conti Actor / other Date

    Support: - Decryption tool. - Your data will be wiped from our servers - Security improvement tips

  120. Message 120 From Victim Victim Date

    [redacted]: And the files will be uploaded to mega.nz for us to review?

  121. Message 121 From Conti Actor / other Date

    Support: we can upload on mega. yes.

  122. Message 122 From Victim Victim Date

    [redacted]: Ok, we'll be in touch. It may be hard since this is a holiday weekend but we'll send an update

  123. Message 123 From Victim Victim Date

    [redacted]: We're hoping to pay by tomorrow, since today is a holiday. Ok?

  124. Message 124 From Conti Actor / other Date

    Support: Yes. Let me know as soon as the transfer is made.

  125. Message 125 From Victim Victim Date

    [redacted]: Still here? Can you confirm the wallet for $450,000?

  126. Message 126 From Conti Actor / other Date

    Support: Yes, just a minute.

  127. Message 127 From Conti Actor / other Date

    Support: The BTC wallet is the same: [redacted]

  128. Message 128 From Victim Victim Date

    [redacted]: We have paid. Please confirm

  129. Message 129 From Conti Actor / other Date

    Support: The payment is pending. As soon as it's confirmed you will be provided with decryption software with the instructions on how to use it.

  130. Message 130 From Victim Victim Date

    [redacted]: Ok. And when will get access to the files that you took?

  131. Message 131 From Conti Actor / other Date

    Support: We will upload them to the mega.nz share the soonest possible.

  132. Message 132 From Victim Victim Date

    [redacted]: Do you have our tool yet?

  133. Message 133 From Conti Actor / other Date

    Support: Will be ready within next 4-5 hours.

  134. Message 134 From Conti Actor / other Date

    Support:  [redacted]_decryptor.exe [ 102kB ]

  135. Message 135 From Victim Victim Date

    [redacted]: We're taking a look now. Any update on mega.nz?

  136. Message 136 From Conti Actor / other Date

    Support: It's pretty much data so it keeps being uploaded. Will update you as soon as it's ready.

  137. Message 137 From Victim Victim Date

    [redacted]: Thank you. Please keep us updated

  138. Message 138 From Victim Victim Date

    [redacted]: Will it be available today?

  139. Message 139 From Conti Actor / other Date

    Support: please wait. about 1 tb

  140. Message 140 From Conti Actor / other Date

    Support: %50 ready wait

  141. Message 141 From Conti Actor / other Date

    Support: %90 ready

  142. Message 142 From Victim Victim Date

    [redacted]: Ok. Please keep us updated

  143. Message 143 From Victim Victim Date

    [redacted]: Is there any update on when mega.nz will be ready?

  144. Message 144 From Conti Actor / other Date

    Support: i check now wait

  145. Message 145 From Conti Actor / other Date

    Support: https://mega.nz/folder/[redacted] check please download all and open first archive unzip and see write please and we will delete from mega

  146. Message 146 From Victim Victim Date

    [redacted]: Thank you. I will let you know.