// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with C7Cd31Eaaf9De9Ac.
The negotiation consisted of 71 messages exchanged over Unknown.
The initial ransom demand was $2.0M. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[C7Cd31Eaaf9De9Ac] — 2024-09-17T19:33:22.282577Z — Message 1/71
hello? there was a readme.txt file with instructions to come to this site. can you please explain what is going on? the files have .dragonforce_encrypted on the end of them and are not opening.
[Dragonforce] — 2024-09-17T19:36:30.576866Z — Message 2/71
Hi, wait.
[Dragonforce] — 2024-09-17T19:40:36.490148Z — Message 3/71
Attachment sent: tree_mastery.zip (3.38 MB)
[Dragonforce] — 2024-09-17T19:40:55.408331Z — Message 4/71
Besides the fact that the files on your network are encrypted, you have also lost some of them. They are with us. Here is a list of them.
[C7Cd31Eaaf9De9Ac] — 2024-09-17T19:50:03.47268Z — Message 5/71
what is this? a list of the files? what do you mean by 'lost'? were they deleted?
[Dragonforce] — 2024-09-17T19:51:59.904327Z — Message 6/71
We have these files. As well as a program to restore information on your computers.
[C7Cd31Eaaf9De9Ac] — 2024-09-17T20:11:08.559673Z — Message 7/71
okay. so in addition to scrambling the files, you also stole files? are the files from this list (the files you stole) still on my computers?
[Dragonforce] — 2024-09-17T20:12:07.496824Z — Message 8/71
Yes, that's right
[C7Cd31Eaaf9De9Ac] — 2024-09-17T20:14:25.993514Z — Message 9/71
all the filenames are scrambled so i don't know what files are what. for proof you can unscramble them, you say you need a certain file type, but i have no idea what files are what on my side.
[C7Cd31Eaaf9De9Ac] — 2024-09-17T20:14:33.330746Z — Message 10/71
what do you want from me??
[Dragonforce] — 2024-09-17T20:16:41.215838Z — Message 11/71
The architecture of the folders with your files is not broken. You can select a small file from a folder whose contents you know, and we will do a test decryption. Examples of such files are described in the rules, they cannot be critical data.
[C7Cd31Eaaf9De9Ac] — 2024-09-17T20:45:28.928091Z — Message 12/71
i will try to guess and find the right files to decode. without the filenames, i simply won't know for sure. can you explain why you attacked me and what you want?
[Dragonforce] — 2024-09-17T20:50:59.419056Z — Message 13/71
You've probably already used Google and know who we are and what we want. We will restore the data from you and delete the data from us after you pay. Otherwise, the data we have will be published. It is often not immediately believed that without payment we will actually publish the data. So check out our blog and make sure we do it.
[C7Cd31Eaaf9De9Ac] — 2024-09-17T20:57:23.92655Z — Message 14/71
i think i understand all of that. but what do you want from me?
[Dragonforce] — 2024-09-17T20:59:08.506013Z — Message 15/71
Money
[C7Cd31Eaaf9De9Ac] — 2024-09-18T22:41:09.808095Z — Message 16/71
here are 3 files from the list you sent me.
[C7Cd31Eaaf9De9Ac] — 2024-09-18T22:41:21.797589Z — Message 17/71
1) [Redacted]20190304.xlsx
[C7Cd31Eaaf9De9Ac] — 2024-09-18T22:41:28.232985Z — Message 18/71
2) [Redacted].msg
[C7Cd31Eaaf9De9Ac] — 2024-09-18T22:41:34.241647Z — Message 19/71
3) [Redacted]23-24.pptx
[Dragonforce] — 2024-09-19T00:44:57.203938Z — Message 20/71
Attachment sent: [Redacted]20190304.xlsx
[Dragonforce] — 2024-09-19T00:46:36.102356Z — Message 21/71
Attachment sent: [Redacted].xlsx (42 KB)
[Dragonforce] — 2024-09-19T00:46:44.547715Z — Message 22/71
Attachment sent: [Redacted].msg (87 KB)
[Dragonforce] — 2024-09-19T00:46:52.872674Z — Message 23/71
Attachment sent: [Redacted]23-24.pptx (3.96 MB)
[C7Cd31Eaaf9De9Ac] — 2024-09-19T14:39:51.66601Z — Message 24/71
does the list of files you sent show all the files you took?
[Dragonforce] — 2024-09-19T14:46:19.756032Z — Message 25/71
Yes
[C7Cd31Eaaf9De9Ac] — 2024-09-19T18:47:02.367298Z — Message 26/71
i have 3 small scrambled files from a windows computer. i have no idea what files they are, but are from a folder that shouldn't have anything important. how do i give these to you to prove to me that you can fix them?
[Dragonforce] — 2024-09-19T19:01:28.85014Z — Message 27/71
You should have uploaded the decryption verification file in the previous step in this dialog. You had instructions on how to do it.
[C7Cd31Eaaf9De9Ac] — 2024-09-19T19:02:53.602854Z — Message 28/71
how do i get back to that step?
[Dragonforce] — 2024-09-19T19:04:30.173636Z — Message 29/71
We have now moved you to this step again. Try refreshing the page.
[C7Cd31Eaaf9De9Ac] — 2024-09-19T19:24:45.283597Z — Message 30/71
okay. i put 1 of the files through
[Dragonforce] — 2024-09-19T19:26:03.175022Z — Message 31/71
You have made sure that we have your files and we have a file recovery tool on your network.
[Dragonforce] — 2024-09-23T15:55:39.527918Z — Message 32/71
Have you already assessed the situation and are ready to discuss payment, or would you like more time? As per our rules, I will need to make an announcement regarding the publication of your data on our blog tomorrow if negotiations continue to drag on.
[C7Cd31Eaaf9De9Ac] — 2024-09-23T19:18:48.399592Z — Message 33/71
What negotiatons? I asked what you want and all you say is money. I'm not sure what I'm missing or should do at this point. I am waiting for you to tell me what you want.
[Dragonforce] — 2024-09-23T19:22:02.852478Z — Message 34/71
Attachment sent: 2023 Form 990 for Mastery Schools.pdf (583 KB)
[Dragonforce] — 2024-09-23T19:22:21.569084Z — Message 35/71
Do you know this document?
[Dragonforce] — 2024-09-23T19:38:52.85204Z — Message 36/71
Usually, for a company of your size, the amount is $2,000,000. But since you are filing tax reports on Form 990, we are ready to reduce it to $950,000. This way you can hide it in the reports and keep the whole incident a secret.
[C7Cd31Eaaf9De9Ac] — 2024-09-23T19:38:54.493669Z — Message 37/71
I know you have my files. You already proved this. What do you want?
[Dragonforce] — 2024-09-23T19:39:45.841953Z — Message 38/71
$950 000
[C7Cd31Eaaf9De9Ac] — 2024-09-24T18:27:01.313374Z — Message 39/71
We are talking through everything and trying to process next steps. Can you confirm for us what we would get if we were to pay you?
[Dragonforce] — 2024-09-24T18:37:36.518164Z — Message 40/71
Read the F.A.Q., there are answers. More specifically, we will not publish your files (we will delete them) you will also receive a decryption program.
[C7Cd31Eaaf9De9Ac] — 2024-09-27T18:36:14.42272Z — Message 41/71
We are meeting next week with finance to see how much we can pay. I'll be back after the weekend. Thanks
[Dragonforce] — 2024-09-27T18:44:56.378567Z — Message 42/71
Okay, i get you. I will turn off the timer until friday next week, to facilitate negotiations. Can you name a day when you will have an answer?
[C7Cd31Eaaf9De9Ac] — 2024-09-30T15:17:36.873675Z — Message 43/71
We are meeting about this now and we simply don't understand why you are asking for so much. Your price is just so high that we honestly don't see anything we can do on our end. We know you have all of our files and know exactly how much money we have, but why ask for more money than you know we have? Paying you seems impossible at such a high amount.
[Dragonforce] — 2024-09-30T15:39:26.310817Z — Message 44/71
Earlier, I sent you the file with your tax records. These are the official documents that you submitted to the tax authorities. They show the amounts of your income and expenses. Is the information you submitted to the tax service unreliable?
[C7Cd31Eaaf9De9Ac] — 2024-09-30T15:44:50.006559Z — Message 45/71
We are a public school. Our "income" isn't normal income like a company. We don't generate revenue and don't have income. We operate on a strict and tight budget.
[Dragonforce] — 2024-09-30T15:51:29.665726Z — Message 46/71
We have reviewed your documentation, not just the file you sent us above. The amount you are being offered is significantly lower than what a commercial organization would receive.
[C7Cd31Eaaf9De9Ac] — 2024-09-30T16:04:17.818395Z — Message 47/71
For that, we are appreciative. I don't mean to be disrespectful or unappreciative, but we just don't have the budget for a massive expense like this. You have all of our documents and can see this. Our athletic department doesn't even have the funds to travel to away sporting events so they are trying to raise funds with bake sales and car washes.
[C7Cd31Eaaf9De9Ac] — 2024-09-30T16:04:27.912689Z — Message 48/71
Listen, I don't want to waste your time. Can you let me know the lowest amount you would be willing to accept so we can see if a payment is even possible?
[Dragonforce] — 2024-09-30T16:07:01.105724Z — Message 49/71
I've given you the amount. Now I expect the amount from you. We will discuss this and eventually come to some figure. It usually happens like this. And if we are not talking about deliberately small amounts, then negotiations can go very quickly, to our mutual satisfaction.
[C7Cd31Eaaf9De9Ac] — 2024-09-30T16:09:43.006456Z — Message 50/71
Okay. We will review the budget and see how much funding we can allocate to this, but please be aware that it won't be much. We also would like to arrive at a mutual agreement. I'll be back
[Dragonforce] — 2024-09-30T16:12:44.302913Z — Message 51/71
Ok
[C7Cd31Eaaf9De9Ac] — 2024-10-01T16:15:42.369077Z — Message 52/71
We think we can pay something around $80,000
[Dragonforce] — 2024-10-01T17:11:13.949515Z — Message 53/71
It seems to me that you misspelled the amount there. Forgot one digit in the number of $800,000
[C7Cd31Eaaf9De9Ac] — 2024-10-01T18:04:00.508225Z — Message 54/71
No, not a typo. We can't offer what we don't have. Anything you can do to make this work?
[Dragonforce] — 2024-10-01T18:09:19.717396Z — Message 55/71
There is one option. You raise the amount to 2 BTC exactly. Now it's about $127,000. And you name the date by which you will pay, if we agree today. And I will try to explain to the management that despite the grants and sponsors, you don't have any more money and we can make such a deal. Perhaps the management will agree.
[C7Cd31Eaaf9De9Ac] — 2024-10-01T19:28:08.456317Z — Message 56/71
We can't commit to anything before we take a closer look at our budget. This is a really large amount for us so we can't act on it instantly. Can we get back to you by the end of the week?
[Dragonforce] — 2024-10-01T19:46:34.793947Z — Message 57/71
The longer the negotiations take, the more difficult it will be for me to convince the management of this amount. But as I promised you, the timer is stopped until the end of the week.
[C7Cd31Eaaf9De9Ac] — 2024-10-01T20:22:04.613704Z — Message 58/71
Thanks
[C7Cd31Eaaf9De9Ac] — 2024-10-04T15:36:53.167683Z — Message 59/71
Good morning. We've been meeting and working on this for a few days now and the most we are able to afford to pay is still $80,000. We are a public school and simply don't have the budget for something like this. That said, we are trying to get an appointment to meet with the State Education Board to see about obtaining an emergency grant. Due to the Jewish holiday, we won't be able to get an appointment until after the weekend. I know you've been very patient with us so far, so all I ask right now is that you continue to remain patient so we can meet after the weekend to try to get the funds to pay you. Is this okay?
[Dragonforce] — 2024-10-04T15:39:24.797947Z — Message 60/71
On monday, will you tell me the result and the date when you will make the payment?
[C7Cd31Eaaf9De9Ac] — 2024-10-04T15:42:37.30867Z — Message 61/71
On Monday, I hope to know when we'll be able to meet with the State BOE. I'll let you know when we'll be able to meet with them. I know for any emergency funding requests, there's a vote that needs to take place and it could take a few days to be approved after the initial meeting.
[C7Cd31Eaaf9De9Ac] — 2024-10-04T15:43:53.639364Z — Message 62/71
My guess is we'll meet on Tuesday or Wednesday and hopefully by Friday we should get approved, or at least have a good idea of when we'll be approved.
[Dragonforce] — 2024-10-04T15:44:12.614878Z — Message 63/71
Ok. I will be waiting for information from you.
[C7Cd31Eaaf9De9Ac] — 2024-10-04T15:44:49.432191Z — Message 64/71
Thank you. I know the timing isn't ideal for either of us, but I appreciate your patience.
[C7Cd31Eaaf9De9Ac] — 2024-10-07T17:38:13.221508Z — Message 65/71
Good morning, I have good news. We have an appointment to meet with the State Board of Education on Wednesday. They are aware of the situation and that we will request emergency funding. After the meeting on Wednesday, I will be back to let you know how it went.
[Dragonforce] — 2024-10-08T01:19:04.001869Z — Message 66/71
Ok, we will be waiting for information from you.
[C7Cd31Eaaf9De9Ac] — 2024-10-09T16:29:17.384845Z — Message 67/71
Good news! We got an appointment to meet with the State BOE to explain the situation and to request emergency funding. We will meet with them on Friday afternoon. They said that they'll have to vote on the measure of the emergency funding request during their next closed-door session, which will happen on Thursday, October 17th in the morning. Once the voting is done, they will let us know right away and then I'll be back here to let you know.
[C7Cd31Eaaf9De9Ac] — 2024-10-09T16:30:49.628919Z — Message 68/71
I know that's not until next week, but we'll just have to be patient because they are the only ones who can help. In the meantime, can you please explain in detail how the payment process works?
[Dragonforce] — 2024-10-09T16:34:06.513176Z — Message 69/71
You will need to pay BTC to the wallet address given to you. To exchange USD for BTC, you need to use any intermediary that suits you. We will only accept BTC.
[C7Cd31Eaaf9De9Ac] — 2024-10-09T16:39:16.453079Z — Message 70/71
Okay. We will start looking into that now. I'll be back after the vote next Thursday, the 17th. Once you have a bitcoin address for us to use, please provide it.
[Dragonforce] — 2024-10-09T16:44:03.668073Z — Message 71/71
I can provide it right now. It has been added to the section for payment on your part. And the amount indicated is 2 BTC. Right now it's $123,660