extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Conti — 20210305

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 45 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Conti
Record date
Mar 05, 2021
Messages
45
Participants
Conti, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Conti Actor / other Date

    Welcome! We are ready to help you.

  2. Message 002 From Victim Victim Date

    Our data is encrypted. Is there a way to get it back?

  3. Message 003 From Conti Actor / other Date

    You need pay for decrypt your files. Your price is 900.000$

  4. Message 004 From Conti Actor / other Date

    The faster you pay the better for pricing - you can get discounts.

  5. Message 005 From Conti Actor / other Date

    You need to pay this amount and we will give you decryptor for all your network, file tree on what we have downloaded from your network and wiping log of that information.

  6. Message 006 From Conti Actor / other Date

    You can choose not to pay and then your data will be published in the media with subsequent sale.

  7. Message 007 From Victim Victim Date

    Ok. What kind of discount can we get?

  8. Message 008 From Conti Actor / other Date

    Let me give you an example: If you will decide to pay in nearest 48 hours, you can get 100k discount. We are interested in fast and effective communication, so be wise and don't waste each others time.

  9. Message 009 From Victim Victim Date

    We don't want to waste anyone's time here. While we appreciate the $100k discount, there still is no way we can afford $800k. We're not really even sure we need the decryption at this point. Can you give me a better number to take to the boss so we can weigh our options?

  10. Message 010 From Conti Actor / other Date

    You may refuse to pay this your choice. Then we'll release your hacking information. If this does not make you aware, we will publish some of your data for sale to interested parties. We took a step to meet. Now it's your turn. We're waiting for your best offer.

  11. Message 011 From Victim Victim Date

    Paying you seems like our quickest option to get our data back based on what we are reading compared to restoring. We spoke as a group and could pay you $150k if you promise you can unlock us quickly and you will delete our data and tell us what was taken. This offer only stands for tonight, and we arent going to go back and forth with you. How would we even make payment, do we wire you the money? This is our best and final offer.

  12. Message 012 From Conti Actor / other Date

    Offer of $150,000 to decline. Make the best offer.

  13. Message 013 From Victim Victim Date

    That was our best offer, but we will see if we can justify any higher expense. You wont take $150k but, $800k is way too much for us. We don't want to waste our time or yours. I'm sure you have a number which is the lowest you will accept. If you tell us what the lowest you will accept is, we can see if its something we can afford or if we are better off letting you have the stolen data and rebuilding. The bosses here have told me we need to make a decision today, we can't be negotiating forever, and I'm sure you don't want to be either. We think our 150K is more than reasonable and we were truthful with our highest offer, but if you come close, they owners here might accept.

  14. Message 014 From Conti Actor / other Date

    considering your desire to resolve the issue quickly,the price is 500.000$. Let's solve it fast.

  15. Message 015 From Victim Victim Date

    Logo.png.DATA.[redacted] [ 33kB ]

  16. Message 016 From Victim Victim Date

    SmallLogo.png.DATA.[redacted] [ 17kB ]

  17. Message 017 From Victim Victim Date

    Can you decrypt these files and send them back?

  18. Message 018 From Conti Actor / other Date

    Logo.png.DATA [ 32kB ]

  19. Message 019 From Conti Actor / other Date

    SmallLogo.png.DATA [ 16kB ]

  20. Message 020 From Victim Victim Date

    desktop.ini.[redacted] [ 1kB ]

  21. Message 021 From Victim Victim Date

    We want to come to an agreement but 500k is so much more we can afford. The owner wants me to start on recovery from the backups but it will take a few days and we will be down. He told me we could pay 250k if you agree today and tell us how to pay. If we pay does the unlock go quick? We also found some additional files that are different. Can you prove you can unlock these too?

  22. Message 022 From Victim Victim Date

    vmxnet[redacted].inf.[redacted] [ 34kB ]

  23. Message 023 From Conti Actor / other Date

    Offer of $250,000 to decline.

  24. Message 024 From Victim Victim Date

    The owner is asking me how quick we can be back up and running if we pay and how does payment actually work? If we agree to terms he would like to have this done ASAP so we can put this behind us. So we can stop going back and forth what is the best price you can take?

  25. Message 025 From Conti Actor / other Date

    desktop.ini [ 1kB ]

  26. Message 026 From Conti Actor / other Date

    vmxnet[redacted].inf [ 33kB ]

  27. Message 027 From Conti Actor / other Date

    You can back up really fast, depends of the size of your network. You should buy bitcoins for 500k, and send them to address which will give you.

  28. Message 028 From Victim Victim Date

    Okay, we would prefer to decrypt rather than going through a rebuild, but for 500K we can't do it. We see the proof and know you can decrypt. If you accept $325K, you have a deal, and we can pay you today. We hope that makes sense for both of us. We found a company that we can wire money to and they can send you Bitcoins. Let us know if we should prep the $325K. For this, we need the decryption program, we need to know what you have taken, and we need some sort of proof or promise of deletion of our stolen data.

  29. Message 029 From Victim Victim Date

    We also need to know your Bitcoin address.

  30. Message 030 From Conti Actor / other Date

    If you delay the negotiations, on Monday we will release information about the fact of hacking your network. Further, if you do not understand this, we will publish part of the data to find a buyer for them. We went to your meeting, gave you a good discount. You started pulling time and making us brains. We don't like it. Measures will follow to sober you up. Think three times before you start playing script games with us.

  31. Message 031 From Conti Actor / other Date

    We'll go to your meeting. Price $450,000 That's the minimum and that's for sure.

  32. Message 032 From Conti Actor / other Date

    $450,000 and we agree. Wallet: [redacted]

  33. Message 033 From Victim Victim Date

    Ok. We will work on payment now.

  34. Message 034 From Conti Actor / other Date

    Okay, we're waiting.

  35. Message 035 From Victim Victim Date

    Payment has been been completed. Please send decryption tool as soon as possible. https://www.blockchain.com/btc/tx/[redacted]

  36. Message 036 From Conti Actor / other Date

    Status:Confirmed

  37. Message 037 From Conti Actor / other Date

    Expect you to get everything soon.

  38. Message 038 From Conti Actor / other Date

    Everything will be given to you tomorrow. The technician is now absent.

  39. Message 039 From Conti Actor / other Date

    [redacted]_decryptor.exe [ 103kB ]

  40. Message 040 From Conti Actor / other Date

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2

  41. Message 041 From Conti Actor / other Date

    Wait. Your date is still to be deleted.

  42. Message 042 From Conti Actor / other Date

    [redacted]_tree.txt.7z [ 842kB ]

  43. Message 043 From Conti Actor / other Date

    Wait. Your date is still to be deleted.

  44. Message 044 From Conti Actor / other Date

    SHRED_[redacted].txt.7z [ 7.6MB ]

  45. Message 045 From Conti Actor / other Date

    Your deletion log. Please contact us if you have any questions.