// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with 058F4B92 Ae99 45C7 Bf35 5D2D6754B3De.
The negotiation consisted of 19 messages exchanged over Unknown.
The initial ransom demand was $1.5M. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-05T12:38:21.265342Z — Message 1/19
hello
[Dragonforce] — 2025-07-05T12:38:43.259589Z — Message 2/19
Hi
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-05T12:52:22.162723Z — Message 3/19
I discover your file and contacts on my systems, you said we can get the list of files stolen from us and make a test decrypt, how can we proceed?
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-05T12:53:15.422565Z — Message 4/19
Also what is the price?
[Dragonforce] — 2025-07-05T12:55:23.021448Z — Message 5/19
Yes. We will now provide a list and can do a test decryption of a small file with non-critical information.
[Dragonforce] — 2025-07-05T12:55:59.911414Z — Message 6/19
tree.txt filesize:7771
[Dragonforce] — 2025-07-05T12:59:22.707454Z — Message 7/19
We have backups of your databases. Our encryption cannot be decrypted by third-party methods. Once the timer expires, the decryption tool will be deleted and the data will be published. We want $1,500,000 for the decryption tool and deletion of the data taken from you.
[Dragonforce] — 2025-07-08T17:32:32.083173Z — Message 8/19
The silence is getting too long. To stimulate the discussion, we can publish a notice of the incident, without releasing the actual data. Usually, it takes less than a day for the situation to become public knowledge. Will this expedite our negotiations?
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-08T19:46:49.329194Z — Message 9/19
Can you please tell me how much money you want not to disclose the data and to delete them?
[Dragonforce] — 2025-07-08T19:48:42.147909Z — Message 10/19
We have already written that we want $1,500,000
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-08T20:48:49.100783Z — Message 11/19
We are discussing internally and will get back to you tomorrow. This is a lot of money and not something we can decide easily.
[Dragonforce] — 2025-07-08T20:50:26.181956Z — Message 12/19
Ok. Keep us updated and keep an eye on the timer.
[Dragonforce] — 2025-07-11T06:46:17.458461Z — Message 13/19
On the 8th, you said 'get back to you tomorrow'. Today is the 11th and you haven't kept your promise. Today is the end of the workweek, and if we don't get serious progress today, there will be consequences for breaking your word.
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-11T14:24:34.289693Z — Message 14/19
We have discussed this internally and your offer is too high. We have recovered most of our data, we would still be interested in the decryptor and deletion of the data taken from us, but we cannot offer more than $100,000.
[Dragonforce] — 2025-07-11T14:28:29.208115Z — Message 15/19
There is likely a typo in your proposal. Did you mean to offer $1,000,000? $100,000 is clearly not a sum comparable to the damage, or one that you can afford.
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-11T15:02:16.053799Z — Message 16/19
No, most of us internally do not want to pay criminals. The only way for it to make sense is if it is cheaper than actual damages. $1,000,000 is way above this.
[Dragonforce] — 2025-07-11T15:15:34.851686Z — Message 17/19
I'm sure you've been following the news. You know that some people have chosen to settle, even after the incident became public. They placed a high value on data privacy. What would be the consequences if you were to handle it differently? It would be a significant news story. We expect a serious proposal from you.
[058F4B92 Ae99 45C7 Bf35 5D2D6754B3De] — 2025-07-11T15:36:48.856713Z — Message 18/19
Ok, we will circle back internally on whether we believe we should make a higher offer. We will get back to you on Tuesday (Monday is off in France and we have several stakeholders for this decision)
[Dragonforce] — 2025-07-11T15:53:47.005787Z — Message 19/19
Ok