// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with C2A3C7249797F5Ed.
The negotiation consisted of 66 messages exchanged over Unknown.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[C2A3C7249797F5Ed] — 2024-07-06T21:03:37.765307Z — Message 1/66
Hey you guys got us. How did you get in?
[C2A3C7249797F5Ed] — 2024-07-06T21:07:00.548496Z — Message 2/66
anyone there?
[Dragonforce] — 2024-07-06T21:07:35.631915Z — Message 3/66
yes
[Dragonforce] — 2024-07-06T21:09:21.759828Z — Message 4/66
We are ready to help you solve your problem.
[C2A3C7249797F5Ed] — 2024-07-06T21:11:35.843567Z — Message 5/66
how do we get that data back? But just a heads up we are currently downsizing .
[Dragonforce] — 2024-07-06T21:13:33.844142Z — Message 6/66
We understand your situation. Do you know that you also lost more than 100 GB of data?
[C2A3C7249797F5Ed] — 2024-07-06T21:14:24.054921Z — Message 7/66
That could be possible
[Dragonforce] — 2024-07-06T21:16:46.224555Z — Message 8/66
Would you like us to provide you with a list of these files?
[C2A3C7249797F5Ed] — 2024-07-06T21:17:30.088187Z — Message 9/66
Sure
[C2A3C7249797F5Ed] — 2024-07-06T21:20:00.246571Z — Message 10/66
do you have that list of files?
[Dragonforce] — 2024-07-06T21:20:29.710396Z — Message 11/66
We'll upload it to you now. For privacy reasons, we have not made an announcement on our blog yet.
[Dragonforce] — 2024-07-06T21:28:08.466204Z — Message 12/66
tree.zip filesize:255819
[Dragonforce] — 2024-07-06T21:28:27.947508Z — Message 13/66
You can select 3 files that are not too large so that we can provide confirmation.
[C2A3C7249797F5Ed] — 2024-07-06T21:30:59.993235Z — Message 14/66
│ │ │ │ ├── 7 - Tender Submission │ │ │ │ │ ├── [redacted] - Terms & Conditions.pdf
[C2A3C7249797F5Ed] — 2024-07-06T21:32:02.151836Z — Message 15/66
│ │ │ │ ├── 6 - Drawings - DXF │ │ │ │ │ ├── OD10 ID4.53 P4.5 T0.375 1598656583.dxf
[C2A3C7249797F5Ed] — 2024-07-06T21:32:35.161263Z — Message 16/66
Tunneling Co - Shroud Assembly_210514.3 │ │ │ │ └── 1 - Screw Conveyor Quote Documents- GP MFG │ │ │ │ ├── 2 - Tender Documents │ │ │ │ │ ├── Shroud Assembly.PDF
[Dragonforce] — 2024-07-06T21:38:08.736506Z — Message 17/66
[redacted].pdf filesize:53419
[Dragonforce] — 2024-07-06T21:38:24.146502Z — Message 18/66
OD10 ID4.53 P4.5 T0.375 1598656583.dxf filesize:500
[Dragonforce] — 2024-07-06T21:38:32.796038Z — Message 19/66
Shroud Assembly.PDF filesize:849082
[C2A3C7249797F5Ed] — 2024-07-06T21:44:13.524015Z — Message 20/66
how did you guys get in our network?
[Dragonforce] — 2024-07-06T21:45:34.747322Z — Message 21/66
The price is 400 000$. Payment in BTC.
[C2A3C7249797F5Ed] — 2024-07-06T21:47:38.764541Z — Message 22/66
We cant go that high but Ill talk to my boss
[Dragonforce] — 2024-07-06T21:48:44.693936Z — Message 23/66
We will be waiting for your word.
[C2A3C7249797F5Ed] — 2024-07-08T01:41:31.583431Z — Message 24/66
Hello
[C2A3C7249797F5Ed] — 2024-07-08T01:41:45.202358Z — Message 25/66
We were talking on the tox
[C2A3C7249797F5Ed] — 2024-07-08T01:41:56.11953Z — Message 26/66
Are you here????
[C2A3C7249797F5Ed] — 2024-07-08T02:52:41.840361Z — Message 27/66
Hello are you here?
[C2A3C7249797F5Ed] — 2024-07-08T05:04:09.437624Z — Message 28/66
Hello, I want to pay but don’t have what your asking
[Dragonforce] — 2024-07-08T08:22:14.152603Z — Message 29/66
Hello. You have not yet made a counteroffer to us. How much are you willing to pay?
[C2A3C7249797F5Ed] — 2024-07-08T09:28:13.427297Z — Message 30/66
15k
[Dragonforce] — 2024-07-08T09:32:28.63417Z — Message 31/66
I mean, what kind of serious offer are you ready to make? 15k this is not a serious conversation.
[C2A3C7249797F5Ed] — 2024-07-08T12:27:43.463808Z — Message 32/66
Again I don’t have 200k you saw what we have, you have seen it all, you know I’m not lying, there is no way that I can come up with such amount
[C2A3C7249797F5Ed] — 2024-07-08T12:28:29.343339Z — Message 33/66
We barely survive. We haven’t paid paychecks for two weeks you hacked the network you saw it all you saw all of our financials.
[C2A3C7249797F5Ed] — 2024-07-08T12:29:01.432871Z — Message 34/66
There is no way I can bring 200k not even remotely close to it
[Dragonforce] — 2024-07-08T12:50:50.404381Z — Message 35/66
The amount that you were told is 400k and not 200k
[C2A3C7249797F5Ed] — 2024-07-08T13:05:00.214346Z — Message 36/66
Ha?! 400k??? Sir there is no way on this planet that I can come up with such amount of cash, I cannot get near this number no matter how long this chat will be
[C2A3C7249797F5Ed] — 2024-07-08T13:05:58.931851Z — Message 37/66
If you’re locked on 400k then I’m out of options here, I’ll use old back and try to survive with them
[Dragonforce] — 2024-07-08T13:07:04.190089Z — Message 38/66
We have reviewed your network and studied your company. Based on this information, we have calculated the amount. If you would like to propose another amount, it should be reasonable, not $15k.
[C2A3C7249797F5Ed] — 2024-07-08T13:29:47.451747Z — Message 39/66
You’re kidding me right? If you seen it all and really studying our financials, you would never come up with such amount something that we don’t have access to no matter what we will do, All of our credit cards are maxed out and we are negative in all bank accounts you hacked our network you saw it all
[C2A3C7249797F5Ed] — 2024-07-08T13:31:08.518433Z — Message 40/66
We haven’t paid paychecks for 2 weeks due to Cash flow issues
[C2A3C7249797F5Ed] — 2024-07-08T13:31:20.688034Z — Message 41/66
So 400k I don’t have sir.
[Dragonforce] — 2024-07-08T13:40:14.4315Z — Message 42/66
Then you can offer another adequate amount and we will consider it. Not 15k.
[C2A3C7249797F5Ed] — 2024-07-08T14:29:57.079091Z — Message 43/66
Please tell me what’s your bottom line here
[Dragonforce] — 2024-07-08T14:32:03.061886Z — Message 44/66
Do you want to offer me a job?
[C2A3C7249797F5Ed] — 2024-07-08T14:48:16.956208Z — Message 45/66
What? Sir, I want to close this today, 15k that’s all I’m able to bring , you saw what we have you have seen it all
[Dragonforce] — 2024-07-08T14:55:19.658686Z — Message 46/66
Yes, we saw what you have, and based on this we said the price. My management wants us to publish an announcement of this incident and turn on the timer. Tell me the price that I can tell the management. Publishing an announcement creates a lot of problems, especially in such cases. We would like to resolve the issue through negotiations, without a public statement.
[C2A3C7249797F5Ed] — 2024-07-08T15:02:21.099381Z — Message 47/66
Posting the data will not bring 400k to the table you can post it now if you wish, this is most definitely not my concern , what your asking is something I cannot get close to, I don’t have access to the cash your asking, 15k is what I can offer 16k max
[Dragonforce] — 2024-07-08T15:04:24.816897Z — Message 48/66
Have you searched Google for information about us?
[C2A3C7249797F5Ed] — 2024-07-08T15:08:37.065381Z — Message 49/66
No idea who you guys are, and I really don’t care, I would like to close this today and go separate ways
[C2A3C7249797F5Ed] — 2024-07-08T15:09:17.519639Z — Message 50/66
I want to pay, but what your asking is not realistic
[Dragonforce] — 2024-07-08T15:13:25.927087Z — Message 51/66
Google it. There is a lot of information about us there. Publishing even an announcement on a blog attracts a lot of attention to the company. Government agencies and special services. We would like to help you avoid problems. We are even ready to reduce the cost to 350k.
[C2A3C7249797F5Ed] — 2024-07-08T15:22:49.989338Z — Message 52/66
Please publish the data. As I said it’s not an issue for me. Please do it now, this will not bring 350k to the table cash that I don’t have access to. I understand that this os your business but what your asking is not in my reality, I cannot even go loans all of our cards are 100% maxed out, you saw it all you hacked our network, you know I don’t lie, I don’t have access to the cash your asking
[C2A3C7249797F5Ed] — 2024-07-08T15:26:14.100095Z — Message 53/66
Please work with me and I’ll pay, but the amount your asking is out of my reach
[Dragonforce] — 2024-07-08T15:28:02.821785Z — Message 54/66
The amount you mention is also unrealistic. If you want to resolve the issue, name the real amount.
[C2A3C7249797F5Ed] — 2024-07-08T16:02:18.299228Z — Message 55/66
Sir, you have seen our situation, you have seen it all, I don’t have access to funds, 15k-16k is the max I can do, all of our accounts are 100% dry, I used all my savings to survive the covid, and since then our business went down drastically, I’m 2 weeks behind on payroll, you saw it all I don’t lie
[C2A3C7249797F5Ed] — 2024-07-08T16:02:40.936324Z — Message 56/66
No bank will give us a loan in our situation
[Dragonforce] — 2024-07-08T16:07:48.975322Z — Message 57/66
You can think about ways to solve this problem. You know what we require.
[C2A3C7249797F5Ed] — 2024-07-08T16:18:22.723917Z — Message 58/66
Please reduce the amount and I’ll pay, I will never be able to get to your numbers
[Dragonforce] — 2024-07-08T16:24:55.653863Z — Message 59/66
Tell me how much you can pay. Not 15k. We have already reduced it from 400k to 350k.
[C2A3C7249797F5Ed] — 2024-07-08T16:31:48.608618Z — Message 60/66
As I said 15-16k again I understand that’s your business but I’m sure you checked and saw our financials you saw it all! There is no way on this planet that I can get to your numbers 15-16k that’s all I can bring I don’t lie and you know it , we are in debt since Covid hit - we never recovered from it
[Dragonforce] — 2024-07-08T16:40:31.457064Z — Message 61/66
Covid was a long time ago. Now the world has changed and the situation in the world is already different. The amount you name does not correspond to your company. I suggest you Google it again, we have a certain strategy and we stick to it. There are articles confirming this. We will not settle for too small a sum. I think you're pretending you don't understand this.
[C2A3C7249797F5Ed] — 2024-07-08T18:41:34.73049Z — Message 62/66
100k
[C2A3C7249797F5Ed] — 2024-07-08T18:41:50.397897Z — Message 63/66
To close this today and now
[Dragonforce] — 2024-07-08T18:56:18.333693Z — Message 64/66
The wallet and the amount of BTC have been adjusted to make this payment.
[C2A3C7249797F5Ed] — 2024-07-08T19:06:02.946139Z — Message 65/66
This key will unlock all files and machines here?
[Dragonforce] — 2024-07-08T19:07:31.094538Z — Message 66/66
Yes. All.