extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Conti — 20210520

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 101 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Conti
Record date
May 20, 2021
Messages
101
Participants
Conti, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Victim Victim Date

    Hi, we got a note to go to this website. Please help!

  2. Message 002 From Victim Victim Date

    hello?

  3. Message 003 From Conti Actor / other Date

    Welcome! We are ready to help you.

  4. Message 004 From Conti Actor / other Date

    Welcome! [redacted]

  5. Message 005 From Conti Actor / other Date

    You need pay for decrypt your files. Your price is 900.000$

  6. Message 006 From Conti Actor / other Date

    Your network was hacked, workstations encrypted and we downloaded many private information from your servers. Note that we have also downloaded a lot of data from your network that in case of not making payment will be published on our website. You need to pay this amount and we will give you decryptor for all your network, file tree on what we have downloaded from your network and wiping log of that information. If you will spend 3 days in silence we will start publushing the information.

  7. Message 007 From Conti Actor / other Date

    We will also try to find a buyer for your data and access to your network if you refuse to pay.

  8. Message 008 From Victim Victim Date

    Hi, thank you for the message I will tell leadership.

  9. Message 009 From Victim Victim Date

    Hello, I spoke with leadership and they told me that they can't afford that amount, and they are still trying to find bitcoin. They said they would pay $55,000 if you would take that, they have someone with that much bitcoin now.

  10. Message 010 From Conti Actor / other Date

    While you continue to communicate with scripts and offer such ridiculous amounts, do not expect in response an adequate price reduction. Reputation is expensive.

  11. Message 011 From Victim Victim Date

    I have no idea what that's supposed to mean. I'm just relaying what they can pay now. If you can't take that then say so and I'll tell them.

  12. Message 012 From Conti Actor / other Date

    Your offer has been rejected. Make a realistic offer based on our offer.

  13. Message 013 From Victim Victim Date

    Ok I've let them know. Leadership would like to know what data you stole from us, can you show us proof?

  14. Message 014 From Conti Actor / other Date

    Expect a lot of evidence.

  15. Message 015 From Victim Victim Date

    Will you please stop with the sarcastic responses? I will be as blunt as you are, although more to the point: do you want to get paid? If so, then let's treat each other with respect and work a deal out. Otherwise you are wasting both of our time, this will go nowhere, and you can trust that I will let everyone know how unprofessional Conti is. This will have severe impact on your ability to be trusted, collect any future ransoms, etc. Maybe you don't care, but I promise it will be known if you continue to act in bad faith. I would like some evidence that you have our data, our leadership team and I think this is a reasonable request. Please respond with something useful to the conversation. Thanks.

  16. Message 016 From Conti Actor / other Date

    You'll get them, wait. That's all we said. Everything will be OK. We'll get you a package of evidence. Wait.

  17. Message 017 From Conti Actor / other Date

    [redacted]_PROOF.7z [ 1.2MB ]

  18. Message 018 From Conti Actor / other Date

    [redacted]_NTLM [ 58kB ]

  19. Message 019 From Conti Actor / other Date

    [redacted]_HOSTS.csv [ 61kB ]

  20. Message 020 From Conti Actor / other Date

    30%_tree_[redacted].txt.7z [ 146kB ]

  21. Message 021 From Conti Actor / other Date

    We will send you 30% of the file tree, you will select any 3 pcs of non-sensitive information and we will provide them to you as evidence.

  22. Message 022 From Conti Actor / other Date

    IT'S YOUR TURN TO PROPOSE. Your information has not been sold to anyone. Until we communicate with you, this will not happen. Let us have a more active and substantive conversation. About the money!

  23. Message 023 From Victim Victim Date

    Can you provide the password that we need to open the.7z files?

  24. Message 024 From Conti Actor / other Date

    Pass: 123123

  25. Message 025 From Victim Victim Date

    Thank you, we've reviewed the files. The leadership team has found another $10k to pay you, will you accept $65k for the decryptor and to destroy our files?

  26. Message 026 From Conti Actor / other Date

    Your offer has been rejected. Make a realistic offer based on our offer.

  27. Message 027 From Victim Victim Date

    Hi, thank you for the response, I will let the leadership team know.

  28. Message 028 From Victim Victim Date

    Hi, I relayed your message to our leadership. They responded that your offer is not realistic, there is no way for them to get that much money to pay you, that you should consider they are a small business and you should ask a small business size ransom. They may be able to get more money to pay you but nothing like what you are asking. It is just a fact. They ask if we could discuss something more realistic?

  29. Message 029 From Victim Victim Date

    We do not have cybersecurity insurance, we are having to scrape together money that was budgeted for other projects. You've already hurt the business enough with the disruption, but to ask more for ransom means you hurt us a second time. Please consider that and let us pay you the $65k that we have available so we can all get back to normal.

  30. Message 030 From Conti Actor / other Date

    65.000 and 900.000 why do you think we should agree to 1\14? Your proposal is not even close to what you can talk about and think about.

  31. Message 031 From Conti Actor / other Date

    Your offer has been rejected. Your offer should be reasonable and based on our offer!

  32. Message 032 From Victim Victim Date

    We would like to purchase 1 computer. Using your math above, we can pay you 1/500 of $900,000 for each computer, which is $1,800. We will also pay $55,000 if you provide deletion and file tree. Can you sell us 1 computer unlocked? If this works maybe we buy more. Also you must provide evidence of deletion and file tree. This for $56,800.

  33. Message 033 From Conti Actor / other Date

    The decryptor works for the entire network. We have no offer for one computer. We expect a reasonable offer from you before the end of the week, if the offer does not come from you, we are forced to start publishing. But we are ready to take steps to meet. Our offer given your offer is $800,000

  34. Message 034 From Victim Victim Date

    Hi, we would appreciate you removing the deadline you just set. In our opinion, deadlines are a bad idea. We have nothing to negotiate with you until the deadline is removed. We simply want to be able to discuss options and think through the best course of action without the added stress of a countdown. We would appreciate the professional courtesy.

  35. Message 035 From Conti Actor / other Date

    And we would appreciate it if you stopped making funny suggestions. In our view, this is a bad one and leads you to publish. We have nothing to negotiate with you until a reasonable amount is offered based on ours offer. We do not want to discuss funny values. will be professional and understand what we wrote to you. Read several times if you do not understand the reason for such actions on our part.

  36. Message 036 From Victim Victim Date

    We have confirmed that all of our data has been restored. I can provide you with screenshots to prove this if you need me to. We don't need your decryptor. That said, we are interested in your promise not to disclose our data, and a deletion log, if you are still interested in selling. We offer $127,500 for your promise not to disclose and if you provide us with a file tree/deletion log. This is the maximum amount of cash that we can dedicate to this. We spent the last 4 days finding the extra cash. Awaiting your response.

  37. Message 037 From Conti Actor / other Date

    We see a constructive dialogue and take a step towards a meeting. our new proposal 700.000$

  38. Message 038 From Conti Actor / other Date

    Evaluate our steps. You can negotiate with us. But offering funny amounts is not the best way for you. It leads to publication.

  39. Message 039 From Victim Victim Date

    Let me help you understand something: the only thing of value you possess is your promise not to disclose our data. If you "publish" "publication" or anything else related to this, you will get nothing.

  40. Message 040 From Victim Victim Date

    That is why I suggested that you remove your deadline; it does neither you nor us any good. If you publish because of a self-inflicted "deadline", you will get nothing.

  41. Message 041 From Victim Victim Date

    Now on to the price. Please stop trying to sell me the decryptor. Please let your boss know that we will pay $127,500 for your promise not to disclose/publish and proof of what you took and proof of the deletion of what you took. Standing by.

  42. Message 042 From Victim Victim Date

    Also, it took 22 hours to get a response earlier. This is also another reason why a deadline is a bad idea. Please rescind the deadline so that we may reach an accord, otherwise this will end with zero payment if you disclose.

  43. Message 043 From Victim Victim Date

    [redacted] Confidential Server.jpg [ 32kB ]

  44. Message 044 From Victim Victim Date

    Proof of our data restored/systems operational:

  45. Message 045 From Victim Victim Date

    [redacted] Desktop Screenshot.JPG [ 239kB ]

  46. Message 046 From Victim Victim Date

    [redacted] Development Tools.jpg [ 202kB ]

  47. Message 047 From Victim Victim Date

    [redacted] Domain Controller.JPG [ 70kB ]

  48. Message 048 From Victim Victim Date

    [redacted] VM Console.JPG [ 75kB ]

  49. Message 049 From Conti Actor / other Date

    You want to show me your steel eggs? We have stronger ones. Look we're not interested in your funny offer and if you don't offer you better, you will be published and this is not communication. You're not the first and we know what smart dialogues look like.

  50. Message 050 From Victim Victim Date

    How much for just deletion of the data? We just need that, your promise and proof that you deleted the data. Can we do business? $155k for that?

  51. Message 051 From Conti Actor / other Date

    We see a constructive dialogue and take a step towards a meeting. our new proposal 672.500$

  52. Message 052 From Victim Victim Date

    Hi, I understand you are trying to get the most money you can from this negotiation. Here's your dilemma: if you publish, you get nothing, and we only want your promised and proof that you destroyed everything. You are negotiating as if we are still trying to buy the decryptor so we can get our data back.

  53. Message 053 From Victim Victim Date

    we already have our data back

  54. Message 054 From Victim Victim Date

    We only want to buy your promise not to disclose the data you stole, and proof that you destroyed it. You've already threatened us with disclosing it. This is not "smart dialogues" I'm just stating facts here.

  55. Message 055 From Victim Victim Date

    And the fact is we have very limited money and if you insist on asking us to pay you this much, or if you disclose or publish, you will get nothing. Can you please check with your higher ups (boss) and explain to them the situation, so that maybe they understand the value exchange we are proposing?

  56. Message 056 From Victim Victim Date

    If we needed the decryptor, I could understand you continuing to ask for the massive amount you are asking for, but we don't need the decryptor. We just want your promise and proof you destroyed our data. How much is that worth to you? If we can't get to a number that is realistic and affordable to us, you will get nothing.

  57. Message 057 From Victim Victim Date

    Also, we cannot pay until Tuesday when the banks open again (Monday is a holiday) IF we can settle on a price.

  58. Message 058 From Victim Victim Date

    You threatened us with a deadline of the end of this week. I would appreciate you removing that deadline so that we can continue to discuss price. Again, if you publish, you get nothing. Standing by

  59. Message 059 From Conti Actor / other Date

    Reputation is expensive, of course 155k good money but it is still not enough. If you want this dialogue to not last and we resolve the issue quickly, we can make a super offer given that you do not need a decryptor. Super offer 400.000$ and we agree.

  60. Message 060 From Victim Victim Date

    Thank you for your willingness to work with us on price. As I mentioned, money is in short supply. I have been authorized to increase our offer to $175k with a promise to pay Tuesday for your promise and proof of deletion. Please understand we are not able to offer more and will have to pay you in at least two seperate payments (1 big 1 smaller). If this is ok, we can agree and will prepare everything for Tuesday.

  61. Message 061 From Conti Actor / other Date

    You didn't appreciate our offer. When we make such discounts, we wait for retaliatory steps. We can also make such discounts in the end you pull time, our time is expensive. Your price returns to original and considering your offer is 650,000

  62. Message 062 From Victim Victim Date

    Hi, your withdrawal of the price creates serious confidence and trust issues for our leadership. We offered all we could in a show of support for your new price, and then you withdrew it. We need you to offer serious prices only, continuing to dither on the price will result in nothing. Please reconsider.

  63. Message 063 From Conti Actor / other Date

    We offered you a serious price, you in turn did not appreciate this offer. You were the first to show your frivolity and desire to play games with us with an increase in offers by 20,000. You didn't appreciate the seriousness of our move. You can fix it.

  64. Message 064 From Victim Victim Date

    You can characterize our offers in whatever way makes you happy, however you still hold nothing in your hand. If you want a productive conversation, let's start at $175k and see where it goes. We have to get approval to offer money to you, and that approval comes in small increments. It is just the nature of how our leadership operates. If you don't like it, sorry. You attacked us.

  65. Message 065 From Conti Actor / other Date

    Offer $175,000 rejected. Make the best offer.

  66. Message 066 From Victim Victim Date

    I will inform leadership

  67. Message 067 From Victim Victim Date

    Our final super-offer is $250k, and we can begin payment today. Standing by.

  68. Message 068 From Conti Actor / other Date

    Super offer 350.000$ and we agree.

  69. Message 069 From Victim Victim Date

    Hi, I have informed leadership that you declined the super offer and of your new offer.

  70. Message 070 From Victim Victim Date

    I will return with their response.

  71. Message 071 From Victim Victim Date

    Hi. Leadership replied that if you can't meet us at our offer of $250k just for deletion, then give us the decryptor, destroy our data, and promise not to disclose the data for $300k.

  72. Message 072 From Conti Actor / other Date

    325.000 and we agree.

  73. Message 073 From Victim Victim Date

    Ok, I will inform leadership. We will give you files to prove you can decrypt prior to payment, if leadership agrees. We can pay $150k per day if leadership accepts.

  74. Message 074 From Victim Victim Date

    Leadership agrees to $325,000. We will begin paying tomorrow, it will take until Tuesday to get it done completely.

  75. Message 075 From Victim Victim Date

    We would like to get the file tree from you after partial payment tomorrow, we can get the rest from you after final payment, if you are ok with that.

  76. Message 076 From Victim Victim Date

    If you need to wait until final payment for all items, just let us know, but the file tree will be useful now rather than at the end.

  77. Message 077 From Victim Victim Date

    Please provide payment instructions and address

  78. Message 078 From Victim Victim Date

    Hi, we are approaching the end of the day for us to be able to make payment today. We need the payment instructions

  79. Message 079 From Conti Actor / other Date

    BTC wallet: [redacted]

  80. Message 080 From Conti Actor / other Date

    $325.000

  81. Message 081 From Victim Victim Date

    Hi, first payment sent ($150.000), next payment in 24hrs ($150.000), then final payment 24 hrs after that one ($25.000)

  82. Message 082 From Victim Victim Date

    Hi, second payment sent ($150.000), next payment in 24 hrs ($25.000)

  83. Message 083 From Victim Victim Date

    Can you acknowledge payment?

  84. Message 084 From Conti Actor / other Date

    Yes

  85. Message 085 From Conti Actor / other Date

    We wait $25.000

  86. Message 086 From Conti Actor / other Date

    2\3 payments accepted

  87. Message 087 From Victim Victim Date

    Thank you, next payment today

  88. Message 088 From Victim Victim Date

    Last payment just sent 3/3, $25.000

  89. Message 089 From Victim Victim Date

    Please provide file tree, deletion log, and decryptor once payment is confirmed.

  90. Message 090 From Conti Actor / other Date

    Wait

  91. Message 091 From Conti Actor / other Date

    [redacted]_decryptor.exe [ 103kB ]

  92. Message 092 From Conti Actor / other Date

    Decryptor: 1) Launch the decryptor under Administrative rights 2) Wait till the decryptor window is closed 3) if any of the files haven't changed the extension back to the original - repeat 1 and 2

  93. Message 093 From Victim Victim Date

    Hi, we would like the File Tree and destruction log please.

  94. Message 094 From Victim Victim Date

    Hi, still waiting on file tree and destruction log

  95. Message 095 From Victim Victim Date

    Hi, we finished paying on Monday. It's Friday. Please provide file tree and destruction log

  96. Message 096 From Conti Actor / other Date

    Within 48 hours, you'll get everything. Small technical faults.

  97. Message 097 From Conti Actor / other Date

    [redacted]_tree.zip [ 589kB ]

  98. Message 098 From Victim Victim Date

    Hi, thank you for the file tree, can you please provide the deletion log?

  99. Message 099 From Conti Actor / other Date

    The deletion is still in progress. You will receive the log as soon as it is complete

  100. Message 100 From Conti Actor / other Date

    [redacted]_shred.zip [ 6.2MB ]

  101. Message 101 From Victim Victim Date

    Thank you. Now that we've paid the ransom amount, would you be willing to let us know how we were breached so that we can take necessary precautions in the future?