extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Conti — 20210315

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 49 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Conti
Record date
Mar 15, 2021
Messages
49
Participants
Conti, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    Hello - We are here to discuss the situation as a smaller company we are trying to understand what you are asking in this case to get us our files back?

  2. Message 002 From Conti Actor / other Date

    hello please wait answer

  3. Message 003 From Conti Actor / other Date

    As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website https://continews.icu The recovery price is $1100000 (20 BTC). If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch. The example data pack will be provided, which will include part of the file list and some actual data you can review.

  4. Message 004 From Conti Actor / other Date

    The total amount of data downloaded from your network is 835 GB. The 30% of the whole file listing is attached. You can choose any 2 files from the list and we will upload them as a proof.

  5. Message 005 From Conti Actor / other Date

    30percentlisting.txt [ 5.9MB ]

  6. Message 006 From Victim Victim Date

    [redacted]_ENCRYPTED.zip [ 675kB ]

  7. Message 007 From Victim Victim Date

    [redacted]-Finances.zip [ 211kB ]

  8. Message 008 From Victim Victim Date

    [redacted]-Dev.zip [ 128kB ]

  9. Message 009 From Victim Victim Date

    can you demonstrate decryption?

  10. Message 010 From Conti Actor / other Date

    [redacted]_ENCRYPTED.zip [ 651kB ]

  11. Message 011 From Conti Actor / other Date

    Of course.

  12. Message 012 From Victim Victim Date

    appreciated.

  13. Message 013 From Victim Victim Date

    could you give us these files: ~$Budget 2020-2021 COVID19-2 [redacted]-HSBC v1.1 FINAL FINAL.xlsx [165 Bytes] ~$[redacted] 2021-2022.xlsx [165 Bytes] ~$[redacted] 21-01-2021.xlsx [165 Bytes]

  14. Message 014 From Conti Actor / other Date

    Yes. Wlll upload soon.

  15. Message 015 From Conti Actor / other Date

    https://www.sendspace.com/file/[redacted] [redacted] https://www.sendspace.com/delete/[redacted]/[redacted]

  16. Message 016 From Victim Victim Date

    appreciate. We will download and review.

  17. Message 017 From Victim Victim Date

    We understand you are asking for 1.1Mil. This is not an amount we can consider as it is more than our annual revenue. You will find if you search us, that we went bankrupt 2 years ago and have been on the losing side since. We would like to discuss how to proceed, but we do not know where to start with this amount.

  18. Message 018 From Conti Actor / other Date

    We can provide you with 25% discount as a step forward.

  19. Message 019 From Victim Victim Date

    Hi - We are trying to see what we can do but meanwhile can you send me any files from: 1. E:\mssql\data folder on a server called [redacted]-db? log files or something like that. Also on a server called [redacted] can you get me a file from c:\users\[redacted]\documents\[redacted]\exports please? thank you.

  20. Message 020 From Conti Actor / other Date

    We are looking for those files. Will upload soon.

  21. Message 021 From Conti Actor / other Date

    We can't find the files you requested by path. We need the exact file names to look for.

  22. Message 022 From Victim Victim Date

    can you find a table in a database if we give you the table name?

  23. Message 023 From Conti Actor / other Date

    Well, yes, I suppose. But please specify the database name too.

  24. Message 024 From Victim Victim Date

    can you see if you have these files: A) [redacted] server - "TransfertsWeb7DerniersJours_20201220" and "TransfertsWeb7DerniersJours_20201213"; and B) vRaym-DB - "templog.ldf"

  25. Message 025 From Conti Actor / other Date

    Yes. We have them. Although we have already provided two files of your choice that you have requested I can provide only parts of those files as a confirmation. StoreName_FromSomme de TotalQtySomme de TotalRetail [redacted]54717956.87 StoreName_FromSomme de TotalQtySomme de TotalRetail [redacted]862923.85

  26. Message 026 From Conti Actor / other Date

    We have provided everything you asked by now. Now we are waiting for your decision. It's been a week already and we are almost past the deadline to we need your decision by tomorrow.

  27. Message 027 From Victim Victim Date

    You have provided everything we asked.

  28. Message 028 From Victim Victim Date

    It is appreciated. It is also used to build some trust in a situation like this.

  29. Message 029 From Victim Victim Date

    We also used the time to see what we can raise in funds because even 800k is not an amount anything will give us.

  30. Message 030 From Victim Victim Date

    I will respond tomorrow we are trying one other thing and then I will be able to say if and what we can offer.

  31. Message 031 From Conti Actor / other Date

    Ok, we are waiting for the news by tomorrow.

  32. Message 032 From Victim Victim Date

    Hi - we reviewed all the files. The data is not worth much. We are recovered so we do not need decryptors. We cannot pay what you are asking. We are on the verge of insolvency and this certainly does not help. I can pay you 50K to make this go away if you promise and provide assurance that you deleted all the data. This is as much as I am able to do without triggering law enforcement and the banks after me.

  33. Message 033 From Conti Actor / other Date

    50K is totally impossible. As you can find our from the open sources our "average" is more than a mil. Although we are ready to make a step forward towards you and go down to $450k (if the decryptor is not required, only for the data deletion). My team will not let me go even a dollar lower than $450k.

  34. Message 034 From Victim Victim Date

    We cannot do that, we do not have that kind of funds available to give. I guess we cannot proceed because I cannot give you what you want and I do not have.

  35. Message 035 From Conti Actor / other Date

    Understandable. Too bad though. We will start auctioning your data to your competitors within next 48 hours.

  36. Message 036 From Victim Victim Date

    Let me know who is interested in buying this information, might be a potential buyer:) Like I said the price is far too high that I cannot budge more than +10k. Of course if you decide to access I promise not to tell the media that the amount but sounds like we are not even in the ball-park.

  37. Message 037 From Conti Actor / other Date

    That's just impossible in our enterprise.

  38. Message 038 From Conti Actor / other Date

    Let me discuss with the team to reevaluate your abilities and I will get back to you.

  39. Message 039 From Conti Actor / other Date

    Well. Ok, we can make it 100k and finish this one on a private terms from both sides.

  40. Message 040 From Victim Victim Date

    Hi - Ok, all agreed; 100k. Please send wallet

  41. Message 041 From Victim Victim Date

    Hello - OK, we confirm 100k to resolve this. We have a bitcoin broker ready to do transfer today. Please confirm on payment you will provide: 1. complete file tree of the data downloaded from our network and a deletion log of all of the data, 2. confirmation that you deleted and will never publish any of our data, including our chat, now or in the future, and 3. a security report on how we got hacked, and how we can prevent future problems Please confirm 1 to 3 and send us the bitcoin wallet address.

  42. Message 042 From Conti Actor / other Date

    All of those is confirmed The wallet is: [redacted]

  43. Message 043 From Victim Victim Date

    OK standby

  44. Message 044 From Victim Victim Date

    OK, the broker sent $100K / 1.8650 bitcoins. Please confirm receipt and provide to us the deal items as soon as possible, thank you.

  45. Message 045 From Conti Actor / other Date

    The payment is received. We will provide the decryption tool the soonest possible.

  46. Message 046 From Conti Actor / other Date

    [redacted]_decryptor.exe [ 103kB ]

  47. Message 047 From Conti Actor / other Date

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2

  48. Message 048 From Victim Victim Date

    OK - thanks. Regarding our data and files, can you please provide the full 100% file-tree list and proof of shred/deletion. Also, the security report of what happen so we can improve our network. thank you.

  49. Message 049 From Conti Actor / other Date

    Yes, we will keep you updated on this one.