Conti — 20210517

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date 17/05/2021, 19:05:39

   we received your ransom note. Can you provide the proof pack you mentioned

2. Message 002 From Conti Actor / other Date 17/05/2021, 21:35:39

   Welcome! [redacted]

3. Message 003 From Victim Victim Date 17/05/2021, 21:37:06

   Hello!

4. Message 004 From Conti Actor / other Date 17/05/2021, 21:37:07

   You need pay for decrypt your files. Your price is 1.500.000$

5. Message 005 From Victim Victim Date 17/05/2021, 21:37:20

   can you send us a proof pack

6. Message 006 From Conti Actor / other Date 17/05/2021, 21:37:29

   You need to pay this amount and we will give you decryptor for all your network, file tree on what we have downloaded from your network and wiping log of that information. You can choose not to pay and then your data will be published in the media with subsequent sale. If you will spend 3 days in silence we will start publushing the information.

7. Message 007 From Victim Victim Date 17/05/2021, 21:40:55

   can you let us know the amount of information that you have taken

8. Message 008 From Conti Actor / other Date 17/05/2021, 21:46:54

   We have your accounting, legal documents, finance, contracts and personal correspondence, DB, that's all I can say. It's about 200 Gigabate. You will receive a complete list of files after payment as well as a log of their removal from our server.

9. Message 009 From Conti Actor / other Date 17/05/2021, 21:49:21

   [redacted]_proof.7z [ 2.1MB ]

10. Message 010 From Conti Actor / other Date 17/05/2021, 21:49:38

    Proof Pack. Pass: 123123

11. Message 011 From Conti Actor / other Date 17/05/2021, 21:50:39

    If you delay the negotiations, on Monday we will release information about the fact of hacking your network. Further, if you do not understand this, we will publish part of the data to find a buyer for them.

12. Message 012 From Conti Actor / other Date 17/05/2021, 22:26:56

    We will also try to find a buyer for your data and access to your network if you refuse to pay.

13. Message 013 From Victim Victim Date 18/05/2021, 20:53:35

    Thanks for providing the data. We are struggling with the claim that you have 200GB of data. Can you provide further examples of the information as the random samples are not moving management.

14. Message 014 From Conti Actor / other Date 18/05/2021, 22:35:11

    We will send you 30% of the file tree, you will select any 3 pcs of non-sensitive information and we will provide them to you as evidence.

15. Message 015 From Victim Victim Date 18/05/2021, 23:07:56

    Ok

16. Message 016 From Victim Victim Date 19/05/2021, 17:31:19

    Checking in

17. Message 017 From Conti Actor / other Date 20/05/2021, 00:03:59

    Wait.

18. Message 018 From Conti Actor / other Date 20/05/2021, 00:11:40

    30%_DATA_[redacted].txt.7z [ 794kB ]

19. Message 019 From Conti Actor / other Date 20/05/2021, 00:11:55

    Pass: 123123

20. Message 020 From Conti Actor / other Date 20/05/2021, 22:04:04

    Let's not delay the negotiations. This has a negative effect on the fact of publishing you. Be more active.

21. Message 021 From Victim Victim Date 20/05/2021, 23:48:37

    We should have an offer to you shortly as management has been discussing.

22. Message 022 From Conti Actor / other Date 21/05/2021, 00:17:36

    Make a reasonable offer based on our offer.

23. Message 023 From Victim Victim Date 21/05/2021, 03:24:01

    Can you provide the following three files

24. Message 024 From Victim Victim Date 21/05/2021, 03:24:09

    1../SRV[redacted]/E/[redacted]/SALES/Contractor/[redacted]/[redacted]/[redacted]\ Miscellaneous\ Control\ Equipment/5\ -\ Submittals/[redacted]/[redacted]\ Hydro\ Testing.pdf 2../SRV[redacted]/E/[redacted]/SALES/Contractor/[redacted]/1\ ARCHIVE\ -\ OLD\ PROJECTS/2006-2010\ Fiscal\ Years/[redacted]\ -\ [redacted]/[redacted]/Proposal/Complete\ Proposal_RFQ\ [redacted]_[redacted]_122106.pdf 3../SRV[redacted]/E/[redacted]/SALES/Contractor/[redacted]\ [redacted]/[redacted]\ Generating\ [redacted]\ Steam\ Bypass\ [redacted]/FW\ [redacted]\ Generating\ [redacted\ -\ Request\ for\ Proposal\ -\ Steam\ Bypass\ [redacted].msg

25. Message 025 From Conti Actor / other Date 21/05/2021, 13:51:11

    [redacted]_proof1.7z [ 1.6MB ]

26. Message 026 From Conti Actor / other Date 21/05/2021, 13:52:00

    Pass: 123123

27. Message 027 From Conti Actor / other Date 21/05/2021, 13:56:08

    Let's not delay the negotiations. This has a negative effect on the fact of publishing you. Be more active.

28. Message 028 From Victim Victim Date 21/05/2021, 20:43:10

    Management is requesting more time to formulate an offer. Thank you for your patience

29. Message 029 From Conti Actor / other Date 21/05/2021, 20:51:38

    How long do you need? You wanted to agree quickly, but you yourself are delaying the negotiations.

30. Message 030 From Victim Victim Date 22/05/2021, 15:08:38

    After many discussions with management, they have settled at $150K for the amount. This is based on the valuation of the information provided and other risk factors in the environment. Management hopes to settle quickly, can we agree

31. Message 031 From Conti Actor / other Date 22/05/2021, 15:49:04

    Your offer has been rejected. Make a more reasonable offer based on our offer.

32. Message 032 From Conti Actor / other Date 22/05/2021, 15:51:00

    150.000 and 1.500.000 why do you think we should agree to 1\10? Your proposal is not even close to what you can talk about and think about.

33. Message 033 From Victim Victim Date 22/05/2021, 22:29:40

    We are willing to negotiate to a fair settlement. What number can you offer?

34. Message 034 From Conti Actor / other Date 23/05/2021, 19:53:19

    Well, we see constructive dialogue and make a discount. Your new price is $1.350.000

35. Message 035 From Victim Victim Date 24/05/2021, 00:40:33

    We will discuss as a management team and get back in touch shortly.

36. Message 036 From Victim Victim Date 24/05/2021, 15:32:39

    Management has informed me that $200K is what we can offer. Hopefully we can get this to closure.

37. Message 037 From Conti Actor / other Date 24/05/2021, 21:10:43

    Well, we see constructive dialogue and make a discount. Your new price is $1.300.000

38. Message 038 From Conti Actor / other Date 25/05/2021, 17:22:22

    do you delay negotiations, do you have constructive proposals?

39. Message 039 From Victim Victim Date 26/05/2021, 17:49:21

    Based on the valuation of the data, we are at $200K. We hope you will be able to accept your offer

40. Message 040 From Conti Actor / other Date 27/05/2021, 17:02:06

    Well, we see constructive dialogue and make a discount. Your new price is $900.000. Your next step.

41. Message 041 From Conti Actor / other Date 27/05/2021, 17:03:22

    Evaluate our steps. You can negotiate with us. But offering funny amounts is not the best way for you. It leads to publication.

42. Message 042 From Victim Victim Date 27/05/2021, 20:53:26

    Let me talk with my bosses

43. Message 043 From Conti Actor / other Date 29/05/2021, 22:27:15

    do you delay negotiations, do you have constructive proposals?

44. Message 044 From Victim Victim Date 01/06/2021, 17:39:48

    My bosses have told me $225K is all we can do. Hopefully we can agree on this one.

45. Message 045 From Conti Actor / other Date 01/06/2021, 22:25:36

    Well, we see constructive dialogue and make a discount. Your new price is $875.000. Your next step.

46. Message 046 From Victim Victim Date 03/06/2021, 16:11:52

    Management has informed me that $250K is the highest we can go to settle our affairs. They also have informed me that while the decryption key would be nice, they do not need it.

47. Message 047 From Conti Actor / other Date 03/06/2021, 20:16:00

    Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.

48. Message 048 From Victim Victim Date 05/06/2021, 00:25:11

    $250K is all we can offer.

49. Message 049 From Conti Actor / other Date 05/06/2021, 00:44:50

    Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.

50. Message 050 From Conti Actor / other Date 07/06/2021, 01:12:34

    Do not delay the negotiations, this will negatively affect the publication.

51. Message 051 From Victim Victim Date 07/06/2021, 16:06:17

    My bosses have told me $250K is all we can do.

52. Message 052 From Conti Actor / other Date 07/06/2021, 20:54:56

    Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.

53. Message 053 From Conti Actor / other Date 07/06/2021, 20:55:03

    Do not delay the negotiations, this will negatively affect the publication.

54. Message 054 From Victim Victim Date 07/06/2021, 21:06:17

    I have given you the best offer I can. I wish I could do more.

55. Message 055 From Conti Actor / other Date 12/06/2021, 01:30:38

    If we don't agree by Tuesday, publications will begin Wednesday. All deadlines are out. Your tactics will lead to a deplorable result for you.

56. Message 056 From Conti Actor / other Date 12/06/2021, 01:30:50

    Offer $250,000 rejected. Make the best offer. Your new price is $850.000. Your next step.

57. Message 057 From Conti Actor / other Date 14/06/2021, 20:31:41

    Publications will begin Wednesday. All deadlines are out. Your tactics will lead to a deplorable result for you.

58. Message 058 From Victim Victim Date 15/06/2021, 06:24:09

    $250K is the best offer. Hopefully we can agree to settle our affairs.

59. Message 059 From Conti Actor / other Date 15/06/2021, 12:00:44

    Publications will begin Wednesday. All deadlines are out. Your tactics will lead to a deplorable result for you.

60. Message 060 From Conti Actor / other Date 16/06/2021, 20:03:41

    Look, we discussed everything and decided. The minimum we can agree to in your case is $350,000. Either we make a deal or we publish you. There's no time to pull conversations.

61. Message 061 From Victim Victim Date 16/06/2021, 21:24:38

    Let me talk with my boss

62. Message 062 From Victim Victim Date 17/06/2021, 18:13:54

    Can you send us the wallet

63. Message 063 From Victim Victim Date 17/06/2021, 23:15:30

    to confirm, we will receive the decryptor, the data (file tree), shred log, not to be posted, and a security report. We are waiting on the wallet upon your confirmation

64. Message 064 From Victim Victim Date 18/06/2021, 04:16:51

    we are ready to move forward once confirmed

65. Message 065 From Conti Actor / other Date 18/06/2021, 10:08:54

    Correct. The wallet for the payment is: [redacted]

66. Message 066 From Victim Victim Date 19/06/2021, 07:14:37

    The wallet has been funded

67. Message 067 From Victim Victim Date 19/06/2021, 07:14:46

    https://bitref.com/[redacted]

68. Message 068 From Conti Actor / other Date 19/06/2021, 09:24:55

    [redacted]_decryptor.exe [ 103kB ]

69. Message 069 From Conti Actor / other Date 19/06/2021, 09:25:07

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2