extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Conti — 20210517

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 56 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Conti
Record date
May 17, 2021
Messages
56
Participants
Conti, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    The note said to contact you here, what do we do next?

  2. Message 002 From Conti Actor / other Date

    Welcome! We are ready to help you.

  3. Message 003 From Victim Victim Date

    our network is locked

  4. Message 004 From Victim Victim Date

    we need your help

  5. Message 005 From Conti Actor / other Date

    Give us some time, and we will definitely help you. Expect instructions please.

  6. Message 006 From Conti Actor / other Date

    Welcome! [redacted]

  7. Message 007 From Conti Actor / other Date

    You need pay for decrypt your files. Your price is 400.000$

  8. Message 008 From Conti Actor / other Date

    You need to pay this amount and we will give you decryptor for all your network, file tree on what we have downloaded from your network and wiping log of that information.

  9. Message 009 From Conti Actor / other Date

    We will also try to find a buyer for your data and access to your network if you refuse to pay.

  10. Message 010 From Victim Victim Date

    we do not have that much money, we are still recovering due to covid.

  11. Message 011 From Conti Actor / other Date

    Make a reasonable offer based on our offer.

  12. Message 012 From Victim Victim Date

    we dont have that much money, help us out, we are in a bad place

  13. Message 013 From Victim Victim Date

    my boss just told me that we can give you $42,850,

  14. Message 014 From Conti Actor / other Date

    Well, we see constructive dialogue and make a discount. Your new price is $357.150

  15. Message 015 From Victim Victim Date

    thats still too much for us, i will take it to my boss

  16. Message 016 From Conti Actor / other Date

    Make a reasonable offer based on our offer.

  17. Message 017 From Conti Actor / other Date

    Reputation is expensive.

  18. Message 018 From Victim Victim Date

    my boss wants proof of what you got, but we can come with 73,250 which is a large amount

  19. Message 019 From Conti Actor / other Date

    Well, we see constructive dialogue and make a discount. Your new price is $326.750

  20. Message 020 From Conti Actor / other Date

    We will send you 30% of the file tree, you will select any 3 pcs of non-sensitive information and we will provide them to you as evidence.

  21. Message 021 From Victim Victim Date

    send us the file tree and i can show it to my boss, with the new amount

  22. Message 022 From Conti Actor / other Date

    wait.

  23. Message 023 From Conti Actor / other Date

    30%_tree_[redacted].txt.7z [ 126kB ]

  24. Message 024 From Conti Actor / other Date

    Pass: 123123

  25. Message 025 From Victim Victim Date

    we want to get this done quickly and can offer $98,350.00

  26. Message 026 From Conti Actor / other Date

    Well, we see constructive dialogue and make a discount. Your new price is $301.650

  27. Message 027 From Victim Victim Date

    we don't have that much, but made some more cuts and can offer 137,500

  28. Message 028 From Conti Actor / other Date

    Well, we see constructive dialogue and make a discount. Your new price is $262.500

  29. Message 029 From Conti Actor / other Date

    We move to meet each other - this positively affects the likelihood of an agreement.

  30. Message 030 From Victim Victim Date

    laptop proposals.pdf.[redacted] [ 3.8MB ]

  31. Message 031 From Victim Victim Date

    Registry Fix.jpg.[redacted] [ 73kB ]

  32. Message 032 From Victim Victim Date

    we would like proof you can decrypt

  33. Message 033 From Conti Actor / other Date

    Wait.

  34. Message 034 From Conti Actor / other Date

    laptop proposals.pdf [ 3.8MB ]

  35. Message 035 From Conti Actor / other Date

    Registry Fix.jpg [ 72kB ]

  36. Message 036 From Victim Victim Date

    if you will accept $182,450 we can make the payment within 24 hours

  37. Message 037 From Conti Actor / other Date

    $200,000 and we agree. Think well, this is our minimum offer.

  38. Message 038 From Victim Victim Date

    We agree to the price for the decryptor, file tree, and proof of deletion. How do we finish this up?

  39. Message 039 From Victim Victim Date

    Also we can't get into our systems, will you give instructions on that also?

  40. Message 040 From Conti Actor / other Date

    BTC Wallet: [redacted]

  41. Message 041 From Conti Actor / other Date

    Once you pay, you'll get a file tree, deletion log, and a decryptor for all your computers.

  42. Message 042 From Victim Victim Date

    What about the machine we cant get into?

  43. Message 043 From Conti Actor / other Date

    What hostnames are the speech about?

  44. Message 044 From Victim Victim Date

    I will get a list from our IT leaders

  45. Message 045 From Conti Actor / other Date

    What's wrong with passwords from accounts? or what? Explain in more detail the problem is not very clear.

  46. Message 046 From Conti Actor / other Date

    Of course, we will help if it depends on us.

  47. Message 047 From Victim Victim Date

    We have made the payment, please let me know it went through

  48. Message 048 From Conti Actor / other Date

    [redacted]_decryptor.exe [ 103kB ]

  49. Message 049 From Conti Actor / other Date

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2

  50. Message 050 From Conti Actor / other Date

    The file tree and deletion log are expected to be checked out within 24 hours.

  51. Message 051 From Victim Victim Date

    How does that work? Do you give us the data back? Sorry but we have never done this before.

  52. Message 052 From Conti Actor / other Date

    Wait for the file list and delete log. will receive within 48 hours. Instructions for working with the decryptor are written above. Get an IT specialist to help you recover.

  53. Message 053 From Victim Victim Date

    can we get our file list and delete log?

  54. Message 054 From Conti Actor / other Date

    [redacted]_tree.zip [ 433kB ]

  55. Message 055 From Conti Actor / other Date

    SHRED_[redacted].zip [ 4.4MB ]

  56. Message 056 From Conti Actor / other Date

    file list and delete log