// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with Bd004D632D87Dba0.
The negotiation consisted of 25 messages exchanged over Unknown.
The initial ransom demand was $450,000. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Bd004D632D87Dba0] — 2025-01-22T20:05:51.321439Z — Message 1/25
hello?
[Dragonforce] — 2025-01-22T21:30:08.489146Z — Message 2/25
Hello. As you can see, your network was encrypted by DragonForce. Also we downloaded your data, so if you don't pay, we will publish it and you will have problems. After payment you will receive decryption software and proof that we've deleted your files. Don't waste your time, in 28 days decryptor will be automatically deleted.
[Bd004D632D87Dba0] — 2025-01-23T19:57:20.438046Z — Message 3/25
you took data? for what?
[Bd004D632D87Dba0] — 2025-01-23T19:57:52.378533Z — Message 4/25
how much do we have to pay?
[Dragonforce] — 2025-01-24T00:01:24.766069Z — Message 5/25
15 BTC. Data is needed for better negotiations. If you don't pay we will publish it so you will have big problems.
[Bd004D632D87Dba0] — 2025-01-24T19:58:52.541737Z — Message 6/25
interwebs say you can tell us what files were taken
[Bd004D632D87Dba0] — 2025-01-27T21:03:38.406842Z — Message 7/25
ok, thank you
[Bd004D632D87Dba0] — 2025-01-27T21:05:28.955672Z — Message 8/25
it says, file not found?
[Dragonforce] — 2025-01-28T19:41:32.154822Z — Message 9/25
Try again, on our side it work.
[Bd004D632D87Dba0] — 2025-01-29T00:47:20.098922Z — Message 10/25
The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.
[Bd004D632D87Dba0] — 2025-01-29T20:52:57.760489Z — Message 11/25
got it
[Bd004D632D87Dba0] — 2025-01-29T21:35:02.623698Z — Message 12/25
is this listing represent all the data that was taken?
[Dragonforce] — 2025-01-30T00:57:58.10373Z — Message 13/25
Yes.
[Bd004D632D87Dba0] — 2025-01-31T21:34:51.65209Z — Message 14/25
the money you want, is a really large number for us. can anything be done about this?
[Dragonforce] — 2025-01-31T22:12:43.978205Z — Message 15/25
If you pay quickly, we can provide a 10% discount.
[Dragonforce] — 2025-02-04T10:14:53.541054Z — Message 16/25
[REDACTED URL]
[Bd004D632D87Dba0] — 2025-02-04T16:36:04.915551Z — Message 17/25
What is this link for?
[Dragonforce] — 2025-02-04T16:39:59.338842Z — Message 18/25
This is a private (hidden) report of a network breach in your company.
[Dragonforce] — 2025-02-04T16:40:34.039585Z — Message 19/25
To incentivize cooperation.
[Bd004D632D87Dba0] — 2025-02-04T20:24:26.202847Z — Message 20/25
it says 388 GB of data?? what is that??
[Dragonforce] — 2025-02-04T20:29:23.559957Z — Message 21/25
The data we downloaded from your network, we gave you a list of files earlier.
[Bd004D632D87Dba0] — 2025-02-04T20:36:42.857329Z — Message 22/25
that represents 388 GB??
[Dragonforce] — 2025-02-04T20:55:52.803959Z — Message 23/25
Yes.
[Bd004D632D87Dba0] — 2025-02-13T14:46:39.576792Z — Message 24/25
you put our name on the blog? i thought we had more time?
[Dragonforce] — 2025-02-13T15:19:39.883836Z — Message 25/25
We gave you the link earlier, by clicking on it there was a timer when the post would become visible. Now you have 6 days to make the payment.