Conti — 20210602

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

1. Message 001 From Victim Victim Date 02/06/2021, 15:17:16

   What do you want?

2. Message 002 From Victim Victim Date 02/06/2021, 15:19:29

   Hello?

3. Message 003 From Victim Victim Date 02/06/2021, 15:22:24

   readme.txt [ 1kB ]

4. Message 004 From Conti Actor / other Date 02/06/2021, 16:39:33

   Hello, please wait answer

5. Message 005 From Victim Victim Date 02/06/2021, 16:43:25

   ok

6. Message 006 From Conti Actor / other Date 02/06/2021, 16:46:55

   As you already know - your network and all of your data were encrypted by CONTI team. Besides the encryption process we've downloaded a large pack of your internal documents and files that will be published in case our negotiations fail. How it happens can be seen on our website. The recovery price is $1700000 (45 BTC). If you want to make sure we can recover all of your data - you can send us the two files of your choice and we will decrypt them free of charge. If we reach mutual agreement your will be provided with decryption tool, none of your internal data will be published and you will be provided with security tips on how to avoid further breaches. We strongly recommend to review our offer in a timely manner to avoid additional expenses from your side on security software and on building the new network from scratch. The example data pack will be provided soon, which will include part of the file tree list and some actual data you can review.

7. Message 007 From Conti Actor / other Date 02/06/2021, 19:42:25

   30perclisting.zip [ 223kB ]

8. Message 008 From Conti Actor / other Date 02/06/2021, 19:43:06

   You can choose any 2 files from the listing, we will discard them as proof that the files were really stolen You can also send 2 files for a free decrypt --- Upon conclusion of the agreement, our price includes 1) Universal decryptor for your network 2) Permanently delete all stolen information + logs of removing 3) Security advisories and report how we infiltrated your system

9. Message 009 From Conti Actor / other Date 02/06/2021, 19:52:47

   datapack.7z [ 47.2MB ]

10. Message 010 From Conti Actor / other Date 03/06/2021, 20:29:32

    Have you reviewed the documents and our offer?

11. Message 011 From Conti Actor / other Date 04/06/2021, 14:51:59

    If we will not receive the response today we shall start transmitting your data to 3-rd parties step by step notifying your clients and employees about the breach and on how you guard their data.

12. Message 012 From Victim Victim Date 04/06/2021, 15:23:33

    we have just pulled down the files for review.

13. Message 013 From Victim Victim Date 04/06/2021, 15:25:59

    i will let you know when we are done.

14. Message 014 From Victim Victim Date 04/06/2021, 15:26:48

    how do we know if you are able to recover our machines?

15. Message 015 From Conti Actor / other Date 04/06/2021, 15:27:25

    You can provide two random low-value encrypted files and we will decrypt them as a proof and upload back

16. Message 016 From Conti Actor / other Date 04/06/2021, 15:28:02

    It took you two days to download files from review? We are not that patient and you should be more operative otherwise we will consider you stalling

17. Message 017 From Victim Victim Date 04/06/2021, 15:51:55

    will provide the files. No, it did not take us 2 days to download the files and review. we only logged back on this morning and saw that you sent them.

18. Message 018 From Victim Victim Date 04/06/2021, 15:52:40

    [redacted] Office.doc.[redacted] [ 533kB ]

19. Message 019 From Victim Victim Date 04/06/2021, 15:52:50

    [redacted].pdf.[redacted] [ 75kB ]

20. Message 020 From Conti Actor / other Date 04/06/2021, 15:53:14

    Will upload the decrypted files asap.

21. Message 021 From Conti Actor / other Date 04/06/2021, 17:03:30

    [redacted].pdf [ 74kB ]

22. Message 022 From Conti Actor / other Date 04/06/2021, 17:03:51

    [redacted] Office.doc [ 533kB ]

23. Message 023 From Victim Victim Date 04/06/2021, 17:46:33

    ok thank you

24. Message 024 From Victim Victim Date 04/06/2021, 21:50:59

    we are currently still reviewing everything.

25. Message 025 From Victim Victim Date 04/06/2021, 21:52:18

    additionally, my higher up are requesting additional proofs because you are asking 45btc which is quite a lot of money.

26. Message 026 From Conti Actor / other Date 04/06/2021, 22:09:21

    What proof do you need? We showed that we can decrypt files Select any 2 files from the listing archive and we will discard them to you

27. Message 027 From Conti Actor / other Date 05/06/2021, 03:31:54

    Having received the decryptor, you can start working in 2 hours

28. Message 028 From Conti Actor / other Date 05/06/2021, 03:32:46

    Read about us on the Internet - we work honestly. It is much more profitable to conclude an agreement with us than to incur losses

29. Message 029 From Victim Victim Date 05/06/2021, 04:00:17

    thats for that additional information. will pass this information along to my boss. I will also let you know the file names once they let me know.

30. Message 030 From Victim Victim Date 05/06/2021, 15:08:34

    Still haven't heard anything yet. Will try to get an answer as soon as possible.

31. Message 031 From Conti Actor / other Date 05/06/2021, 15:23:01

    Ok, keep me updated

32. Message 032 From Victim Victim Date 05/06/2021, 15:28:55

    will do.

33. Message 033 From Victim Victim Date 06/06/2021, 17:01:44

    haven't heard anything yet from my boss (most likely because it is the weekend). I should have more information tomorrow

34. Message 034 From Victim Victim Date 07/06/2021, 15:42:21

    good morning. I have a meeting here shortly and should have those file names for proof of decryption

35. Message 035 From Conti Actor / other Date 07/06/2021, 15:55:10

    hello

36. Message 036 From Conti Actor / other Date 07/06/2021, 15:56:02

    what file names? Are you talking about 100% listing?

37. Message 037 From Victim Victim Date 07/06/2021, 15:58:25

    from the file listing you sent me earlier

38. Message 038 From Conti Actor / other Date 07/06/2021, 16:02:22

    Proof of file decryption - you sent 2 files to us, we deciphered them and threw them off.

39. Message 039 From Conti Actor / other Date 07/06/2021, 16:03:21

    File with the title "30perclisting.zip" Here is a list of 20 - 30 percent stolen information from your network.

40. Message 040 From Conti Actor / other Date 07/06/2021, 16:05:27

    When you conclude an agreement, you will receive a decryptor for your entire network and return the state of computers to their previous state in a few hours

41. Message 041 From Victim Victim Date 07/06/2021, 16:09:02

    yes im sorry. I confused myself.

42. Message 042 From Conti Actor / other Date 08/06/2021, 09:59:41

    any updates?

43. Message 043 From Victim Victim Date 08/06/2021, 15:29:23

    yes sorry, sending the filenames over now.

44. Message 044 From Conti Actor / other Date 08/06/2021, 15:41:50

    ok, waiting.

45. Message 045 From Victim Victim Date 08/06/2021, 16:03:04

    ok finally received the list

46. Message 046 From Victim Victim Date 08/06/2021, 16:03:12

    uploading the text file now

47. Message 047 From Victim Victim Date 08/06/2021, 16:03:35

    FileRequest.txt [ 2kB ]

48. Message 048 From Conti Actor / other Date 08/06/2021, 16:05:01

    Well, it's way more than 2 files, but we will provide.

49. Message 049 From Victim Victim Date 08/06/2021, 16:05:54

    Sorry about that but definitely appreciated!

50. Message 050 From Conti Actor / other Date 08/06/2021, 22:00:10

    2019_[redacted].xlsx [ 43kB ]

51. Message 051 From Conti Actor / other Date 08/06/2021, 22:00:28

    2019_[redacted].xlsx [ 152kB ]

52. Message 052 From Conti Actor / other Date 08/06/2021, 22:00:32

    Logo [redacted].pdf [ 87kB ]

53. Message 053 From Conti Actor / other Date 08/06/2021, 22:00:50

    [redacted].pdf [ 69kB ]

54. Message 054 From Conti Actor / other Date 08/06/2021, 22:00:54

    [redacted] - Employee agreement [redacted].docx [ 44kB ]

55. Message 055 From Conti Actor / other Date 08/06/2021, 22:00:59

    [redacted] - Employee agreement [redacted].docx [ 46kB ]

56. Message 056 From Conti Actor / other Date 08/06/2021, 22:01:04

    [redacted].PNG [ 83kB ]

57. Message 057 From Conti Actor / other Date 08/06/2021, 22:01:08

    Agreement [redacted].docx [ 42kB ]

58. Message 058 From Conti Actor / other Date 08/06/2021, 22:01:11

    2020 [redacted] (1).xlsx [ 21kB ]

59. Message 059 From Conti Actor / other Date 08/06/2021, 22:01:51

    [redacted].pdf [ 5.4MB ]

60. Message 060 From Victim Victim Date 09/06/2021, 19:48:31

    thank you, pulling those files down now

61. Message 061 From Victim Victim Date 10/06/2021, 22:33:54

    just wanted to let you know, my boss and the higher ups are having meetings to discuss this. I will keep you updated, as much as i can.

62. Message 062 From Conti Actor / other Date 11/06/2021, 00:15:13

    thanks

63. Message 063 From Victim Victim Date 13/06/2021, 14:26:20

    definitely appreciate your patience. Haven't received work yet (most likely due to the weekend). Will keep you updated.

64. Message 064 From Victim Victim Date 16/06/2021, 17:56:06

    do we have an agreement?

65. Message 065 From Conti Actor / other Date 16/06/2021, 18:02:14

    We are still waiting, but not for too long.

66. Message 066 From Victim Victim Date 16/06/2021, 18:22:08

    are you declining our offer?

67. Message 067 From Conti Actor / other Date 16/06/2021, 18:28:09

    would you please repeat your offer, seems like your message didn't go through

68. Message 068 From Victim Victim Date 16/06/2021, 18:29:28

    This message was send before - thats still out of our range($274,350). our offer $175k.

69. Message 069 From Conti Actor / other Date 16/06/2021, 18:30:16

    I an confused, where have you sent your offer?

70. Message 070 From Conti Actor / other Date 16/06/2021, 18:30:34

    I don't see any relevant message within this chat

71. Message 071 From Victim Victim Date 17/06/2021, 15:19:02

    woah... I am just seeing those messages now. I did not send those messages

72. Message 072 From Victim Victim Date 17/06/2021, 15:21:07

    are you in talks with other people? maybe the framework picked up cross talk?

73. Message 073 From Conti Actor / other Date 17/06/2021, 15:21:44

    Perhaps one of your employees writes here

74. Message 074 From Conti Actor / other Date 17/06/2021, 15:23:47

    Send your current offer now

75. Message 075 From Conti Actor / other Date 17/06/2021, 16:22:00

    No, that's impossible, suppose some of your employees send the messages, maybe we should move to another chat making it private?

76. Message 076 From Victim Victim Date 17/06/2021, 18:19:20

    i am working on getting that answer for you. yeah moving to a new chat might be best. how can we do that?

77. Message 077 From Victim Victim Date 17/06/2021, 20:41:17

    i have an update from my boss/higher ups

78. Message 078 From Conti Actor / other Date 17/06/2021, 20:42:04

    I will provide the new chat ID within an hour.

79. Message 079 From Victim Victim Date 17/06/2021, 20:42:19

    ok thanks.

80. Message 080 From Victim Victim Date 18/06/2021, 16:56:18

    Ok, i made it over to that chat and sent a msg.

81. Message 081 From Conti Actor / other Date 18/06/2021, 17:00:48

    Ok, let's move there, should I block this chat forever?