// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with 7A313D13Eb6B4E58.
The negotiation consisted of 32 messages exchanged over Unknown.
The initial ransom demand was $450,000. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[7A313D13Eb6B4E58] — 2025-04-08T20:28:51.424478Z — Message 1/32
We found your note. Where is the listing? Is there a link on your page somewhere?
[Dragonforce] — 2025-04-08T20:41:38.922911Z — Message 2/32
tree.txt filesize:4533984
[Dragonforce] — 2025-04-08T20:42:08.638245Z — Message 3/32
This is a list of files
[Dragonforce] — 2025-04-08T20:58:17.418497Z — Message 4/32
At the moment, information about the incident is completely private. There are no publications yet.
[7A313D13Eb6B4E58] — 2025-04-09T18:15:41.602121Z — Message 5/32
Thank you. We are reviewing the list
[7A313D13Eb6B4E58] — 2025-04-09T19:02:13.854667Z — Message 6/32
[Redacted].JPG, [Redacted].jpeg, [Redacted].pdf
[Dragonforce] — 2025-04-09T19:11:14.457636Z — Message 7/32
[Redacted].xlsx filesize:27582
[Dragonforce] — 2025-04-09T19:11:20.459373Z — Message 8/32
[Redacted].doc filesize:21504
[Dragonforce] — 2025-04-09T19:11:28.440043Z — Message 9/32
[Redacted].JPG filesize:71420
[Dragonforce] — 2025-04-09T19:11:33.675575Z — Message 10/32
[Redacted].jpeg filesize:2807
[Dragonforce] — 2025-04-09T19:11:38.950857Z — Message 11/32
[Redacted].pdf filesize:27068
[7A313D13Eb6B4E58] — 2025-04-11T20:43:35.209059Z — Message 12/32
[Redacted].zip filesize:1521432
[Dragonforce] — 2025-04-11T21:14:55.742893Z — Message 13/32
[Redacted].msg filesize:326656
[Dragonforce] — 2025-04-11T21:15:01.888965Z — Message 14/32
[Redacted].pdf filesize:11648
[Dragonforce] — 2025-04-11T21:15:05.809785Z — Message 15/32
[Redacted].xlsx filesize:27388
[Dragonforce] — 2025-04-11T21:15:08.364957Z — Message 16/32
[Redacted].xlsx filesize:27408
[Dragonforce] — 2025-04-11T21:15:12.482293Z — Message 17/32
[Redacted].doc filesize:321536
[Dragonforce] — 2025-04-11T21:15:16.114719Z — Message 18/32
[Redacted].doc filesize:796672
[7A313D13Eb6B4E58] — 2025-04-12T12:55:24.673494Z — Message 19/32
Reviewing. Whats next?
[Dragonforce] — 2025-04-12T12:57:29.002751Z — Message 20/32
Now we want you to pay us 15 BTC, after which we will give you a decryption tool and delete the data from our servers.
[Dragonforce] — 2025-04-14T20:49:41.059210Z — Message 21/32
If negotiations are not underway, we will publish an incident announcement without publishing the data. That's how he becomes known publicly. If negotiations fail, we publish the data. You wanted privacy, but you stopped negotiating after we mentioned the terms.
[7A313D13Eb6B4E58] — 2025-04-15T17:37:54.509846Z — Message 22/32
That is a huge amount of dollars. We do not have that kind of money. We are a low margin business and these new tariffs are killing us. Please ask us for something that we can actually pay
[Dragonforce] — 2025-04-15T17:39:10.565056Z — Message 23/32
And how much do you think you could pay?
[7A313D13Eb6B4E58] — 2025-04-16T18:14:06.725583Z — Message 24/32
Our business is going through massive downtrends and there is so much uncertainty with tariffs we have no idea how much our sales will drop. You are asking for over a million and we do not have that even if we wanted. Honestly we are more in the 10's of thousands. Please work with us
[Dragonforce] — 2025-04-16T18:23:16.827043Z — Message 25/32
We have examined your documents. Including insurance. We can reduce the amount to 14 BTC.
[7A313D13Eb6B4E58] — 2025-04-19T14:28:56.985330Z — Message 26/32
That is going to be impossible for us. We are willing to discuss the potential of payment but at that amount it we cannot do anything
[Dragonforce] — 2025-04-19T14:38:12.921231Z — Message 27/32
Abstract discussions do not bring real results. The amount that we have named is based on your documents that we have studied. You know these documents, you've seen them, we speak the same language. If you have a different view, then name it and we will discuss it. A serious suggestion, not abstract words.
[7A313D13Eb6B4E58] — 2025-04-21T02:15:28.179287Z — Message 28/32
We are meeting tomorrow to discuss your message. Will report back
[Dragonforce] — 2025-04-21T03:07:48.057451Z — Message 29/32
Ok
[7A313D13Eb6B4E58] — 2025-04-23T17:08:00.885257Z — Message 30/32
We are having a difficult time deciding how to continue this discussion given you are asking for over $1 million. We cannot aford that but we do not want to upset you either. Can you show us a more reasonable amount so we can consider? How do you prove you delete our data if paid?
[7A313D13Eb6B4E58] — 2025-04-27T16:45:24.250486Z — Message 31/32
You posted us so i guess you are no longer interested
[Dragonforce] — 2025-04-28T05:20:53.894675Z — Message 32/32
You knew the conditions. You have received an offer. You've decided to play games. The consequences are now your responsibility.