Dragonforce Ransomware Negotiation — 05F724F8 906E 4739 8177 815852Cc2C3F

Yes

Hello. Your network has been attacked. The files are encrypted, and we also took files from your network. I will now send you a part of the list of these files. You can select 1-3 small files from the list and they will be provided to you as proof. You can also send 1-3 small encrypted files and we will decrypt them as proof of the decryption capability. After that, we will discuss the amount you will pay to receive the decryptor and delete the files we downloaded from you. If we do not reach an agreement before the expiration of the timer that you see, the data taken will be published, and the decryption program will be deleted. It is impossible to decrypt without this program, after removing the decryptor, even we will not be able to do it. You can also see a short list of questions and answers to the right of this chat window.

tree.zip filesize:1626285

Yes, of course, we understand that you want the entire list. At the same time, we don't want to show it to you. We think you understand why, and it's part of the rules that we detailed for you as you requested.

The full list is not being provided because having it would give you the opportunity and time to minimize the damage before publication. This would weaken our position in the negotiations and strengthen yours. For the same reason, waiting until the last minutes of the timer and trying to use that to reduce the amount will not work. Our blog has several examples of chats where people have tried to do this, but it didn't work out. The best strategy now is to do everything as quickly as possible, which will make us as flexible as possible in our ability to negotiate.

[Redacted].xls filesize:34304

[Redacted].xlsx filesize:14645

[Redacted].xlsm.pdf filesize:244620

Yes. By sending part of the list, we can bluff, and you can't fully assess the impact of publication on you. You've understood everything correctly. This is a standard scheme.

There are rules and they are as follows. If you can't figure them out, we recommend that you contact any negotiation company. The usual timeline is to enter into negotiations 1-2 days after the incident, to deal with the files within 2-6 hours, and then proceed to discuss payment. Within 8 days, we haven't made progress with checking the files and haven't started discussing payment. It's surprising, since companies with your profile are popular, judging by our download statistics. And such companies usually try to resolve the issue literally over the first weekend, so that by the beginning of the week, no one notices the incident. You have been provided with a single list, which you will see, and the rest you will be able to view on our blog in a week, if the negotiations are not successful.

You have been provided with the only available file list that you will see. Rules exist and will be followed. If you want to resolve the situation, stop asking for something you cannot get. There are just over 5 days left to resolve the issue.

How you accept this situation is your choice. The rules will not be changed. Currently, there are less than 4 days left to resolve the issue, including payment.

Yes. This was mentioned right away when you asked me to describe the process to you. It's all straightforward. We want $450,000.

Okay. But don't forget that there are 28 hours left on the countdown.

We are always open to a substantive dialogue. The deadline has been extended to Wednesday.