Conti — 20210316

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date 3/16/2021, 12:17:32 AM

   Okay, what comes next?

2. Message 002 From Conti Actor / other Date 3/16/2021, 8:03:37 AM

   As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website. The recovery price is $920000 (17 BTC). If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch. The example data pack will be provided tomorrow, which will include part of the file list and some actual data you can review.

3. Message 003 From Conti Actor / other Date 3/16/2021, 8:42:44 AM

   [redacted]-30percentlisting.txt [ 7.4MB ]

4. Message 004 From Conti Actor / other Date 3/16/2021, 8:44:34 AM

   [redacted]-datapack-example.zip [ 32.4MB ]

5. Message 005 From Victim Victim Date 3/16/2021, 5:22:27 PM

   Can you allow us a few days to read through these? We have our hands full with our servers down and trying to look over the documents

6. Message 006 From Conti Actor / other Date 3/16/2021, 5:40:34 PM

   Yes, you have time till the end of the week. Bit if you would like to receive a 25% discount it will be valid for only two business days.

7. Message 007 From Victim Victim Date 3/16/2021, 10:09:35 PM

   Ok i understand. I will get back to you as soon as possible

8. Message 008 From Victim Victim Date 3/18/2021, 8:18:54 PM

   I will come to this chat tomorrow with a decision. The final management meeting is this afternoon

9. Message 009 From Conti Actor / other Date 3/18/2021, 8:23:16 PM

   Ok, we will be waiting for your reply tomorrow.

10. Message 010 From Victim Victim Date 3/19/2021, 5:31:10 PM

    Ok thank you for giving us time to work through our analysis. With the end of the quarter closing in, our balances allow us to offer $110,000 to you for the deal. Please please take this offer to your side and ask if it is possible to accept. We will wait for your reply

11. Message 011 From Conti Actor / other Date 3/20/2021, 7:58:50 AM

    Unfortunately we cannot accept this offer according to our internal rules, but we've discuss with the team and a ready to make a step forward by going down to $600k

12. Message 012 From Victim Victim Date 3/20/2021, 12:52:11 PM

    Ok, I will tell the team this, but it's the weekend so they won't be able to meet until Monday or Tuesday ok?

13. Message 013 From Conti Actor / other Date 3/20/2021, 1:12:26 PM

    Ok, just update me by Tuesday.

14. Message 014 From Victim Victim Date 3/20/2021, 1:24:04 PM

    Ok yes

15. Message 015 From Victim Victim Date 3/23/2021, 3:58:28 PM

    We are still in talks to see how we could pull authority to go higher but they are moving very very slowly. We have been able to get them to grant authority for a better offer of $145,000. Please tell me if it possible to accept this amount for us.

16. Message 016 From Conti Actor / other Date 3/24/2021, 9:37:54 AM

    That is totally impossible. We have discussed internally and the lowest we can get is $350k. I am not authorized to accept any lower payment.

17. Message 017 From Victim Victim Date 3/24/2021, 9:24:14 PM

    I submitted this to my superiors. I know they want to finish this up as soon as possible, but $350k may still be out of reach. I will check in with you when I hear back.

18. Message 018 From Victim Victim Date 3/25/2021, 9:24:35 PM

    I will get back to you tomorrow with an update. Expenditures over a certain amount have to be approved by executive leadership and we are trying to keep this under that amount so we dont have to go through their approval.

19. Message 019 From Conti Actor / other Date 3/25/2021, 9:38:14 PM

    ok. we will wait

20. Message 020 From Victim Victim Date 3/26/2021, 3:51:30 PM

    Ok. By relocating some of our budget funds, we are able to move our offer higher to $162,000. I know this is lower than you are authorized to accept, but please let me know if your group can make an exception.

21. Message 021 From Conti Actor / other Date 3/26/2021, 4:17:55 PM

    As I have already told, try to allocate $350k I cannot move any forward unfortunately

22. Message 022 From Victim Victim Date 3/26/2021, 5:36:18 PM

    We'll need to find another way, because we cannot risk getting this delayed in the leadership approval process. Otherwise it will take weeks. I will have to look into outside sources for donations.

23. Message 023 From Conti Actor / other Date 3/27/2021, 7:00:01 AM

    Ok. Keep us updated.

24. Message 024 From Victim Victim Date 3/27/2021, 12:26:41 PM

    Please if you have a smaller amount from $350k this will help speed up the process greatly. I know you can't accept $162k, but it's going to be an uphill battle for us to try to double that amount for you. Please let me know

25. Message 025 From Victim Victim Date 3/28/2021, 1:09:05 PM

    Can you please let me know if there is anything you could do. It is going to be challenging battle for us to come up with double the amount from what we have available ($162,000). We want to be able to reach an agreement with you but our executive leadership team is not approving $350,000. Please let me know if you can come down anymore.

26. Message 026 From Conti Actor / other Date 3/29/2021, 7:17:40 AM

    Let's meet in between at the sum of $255k and get this over with. We want to close the deal asap, so the offer is exclusive and valid for only 2 business days.

27. Message 027 From Victim Victim Date 3/29/2021, 5:17:50 PM

    We have our weekly monday meeting this afternoon and I will tell them about the amount and the deadline. I also wish to get this over with.

28. Message 028 From Conti Actor / other Date 3/29/2021, 7:24:31 PM

    Ok, get back to me when the meeting is over.

29. Message 029 From Victim Victim Date 3/30/2021, 7:42:23 PM

    We are able to go up to $172,000. We are too close to the limit at which point we will have to halt and go through the top leadership approval process, which has a high risk of rejection. We do not want to risk them turning us away.

30. Message 030 From Conti Actor / other Date 3/30/2021, 8:47:19 PM

    We agree to accept. The btc wallet for the payment is: [redacted] let me know as soon as the transfer is made.

31. Message 031 From Victim Victim Date 3/31/2021, 5:24:45 PM

    Thank you. I will notify the cfo's office and instruct them to arrange it

32. Message 032 From Victim Victim Date 4/1/2021, 11:11:22 PM

    I'm sorry for the delay on this. They've asked me to come in for a meeting in the morning to confirm the arrangement of payment. I will check in with you after

33. Message 033 From Conti Actor / other Date 4/2/2021, 9:42:34 AM

    It's been a while, let me know when the meeting is over.

34. Message 034 From Victim Victim Date 4/2/2021, 9:44:05 PM

    Thanks for waiting. I guess the executives read some concerning news reports this week that companies who are hit with ransom are getting published anyway even if they try to pay. It scared them. I will make sure it gets done on Monday after they calm down

35. Message 035 From Conti Actor / other Date 4/3/2021, 8:54:37 AM

    We would never do such a thing that will hurt our reputation. The executives shouldn't be worried while dealing with our particular group.

36. Message 036 From Victim Victim Date 4/5/2021, 8:45:14 PM

    I have been in meetings all day. Our leadership has seen more news reports over the weekend that the conti group is publishing people who are offering to pay and they are uncomfortable about this. You said you never do that, but that is not what we read in the news

37. Message 037 From Conti Actor / other Date 4/6/2021, 11:52:50 AM

    I haven't seen these news actually and not sure what it is about.

38. Message 038 From Conti Actor / other Date 4/6/2021, 11:53:09 AM

    We do publish people who do not pay for sure.

39. Message 039 From Victim Victim Date 4/6/2021, 2:03:38 PM

    It says the company offered conti 500k for payment and they got published instead, even though they wanted to pay

40. Message 040 From Victim Victim Date 4/6/2021, 2:04:09 PM

    https://www.insurancejournal.com/news/[redacted].htm

41. Message 041 From Victim Victim Date 4/6/2021, 2:04:30 PM

    https://www.databreaches.net/[redacted]/

42. Message 042 From Conti Actor / other Date 4/6/2021, 2:05:56 PM

    We haven't reached the agreement on the price. That's the only thing why they were published. We already have such an agreement with you - so that is not an issue.

43. Message 043 From Victim Victim Date 4/6/2021, 4:02:49 PM

    Ok. This wallet still ok? [redacted]

44. Message 044 From Conti Actor / other Date 4/6/2021, 4:06:58 PM

    Yes.

45. Message 045 From Victim Victim Date 4/6/2021, 7:57:54 PM

    We are about ready. Are you online?

46. Message 046 From Victim Victim Date 4/6/2021, 8:04:20 PM

    Before we continue, please confirm you will send: 1) decryptor for all systems 2) list of our files 3) tell us how you accessed our network 4) proof our files are destroyed and promise they will never be published

47. Message 047 From Conti Actor / other Date 4/6/2021, 8:06:31 PM

    I do confirm each of those four. By the way, according to our talk I might assume we've dealt before previously, am I right?

48. Message 048 From Victim Victim Date 4/6/2021, 8:08:39 PM

    We have been talking in here for a while if that is what you mean. Are you ready for us to send?

49. Message 049 From Conti Actor / other Date 4/6/2021, 8:11:31 PM

    Yes, we are ready to accept the payment. And no, I meant your recovery company. Nevermind though, I might be mistaken.

50. Message 050 From Victim Victim Date 4/6/2021, 8:52:45 PM

    The payment is done

51. Message 051 From Conti Actor / other Date 4/6/2021, 8:54:49 PM

    I have already processed the request to the tech dept to provide the decryption tool the soonest possible.

52. Message 052 From Victim Victim Date 4/6/2021, 8:55:22 PM

    What is approximate time to receive?

53. Message 053 From Conti Actor / other Date 4/6/2021, 8:58:11 PM

    [redacted]-full-listing.txt [ 24.7MB ]

54. Message 054 From Conti Actor / other Date 4/6/2021, 9:01:58 PM

    [redacted]_decryptor.exe [ 103kB ]

55. Message 055 From Conti Actor / other Date 4/6/2021, 9:02:52 PM

    Please review the full listing and let us know when we can start shredding your data to provide the deletion log.

56. Message 056 From Victim Victim Date 4/6/2021, 9:03:22 PM

    Ok thanks. I will let you know when its time

57. Message 057 From Conti Actor / other Date 4/6/2021, 9:03:41 PM

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2

58. Message 058 From Victim Victim Date 4/9/2021, 8:18:09 PM

    Please keep our chat open while we work on decryption in case we have questions. It is still running

59. Message 059 From Conti Actor / other Date 4/9/2021, 8:23:55 PM

    Sure, let me know when you're over and we will delete the chat.

60. Message 060 From Victim Victim Date 4/19/2021, 8:55:03 PM

    Thanks for waiting. Please proceed with file shredding and send me the delete log when it is ready

61. Message 061 From Victim Victim Date 4/21/2021, 3:16:00 PM

    Did you get my message

62. Message 062 From Conti Actor / other Date 4/21/2021, 4:21:30 PM

    [redacted]-removed.log [ 18.8MB ]

63. Message 063 From Conti Actor / other Date 4/22/2021, 12:36:19 PM

    Shall we delete this chat now?