// Ransomware Negotiation Transcript
Dragonforce Ransomware Negotiation — C2A3C7249797F5Ed
// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with C2A3C7249797F5Ed. The negotiation consisted of 66 messages exchanged.
The initial ransom demand was Unknown. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
Hey you guys got us. How did you get in?
anyone there?
yes
We are ready to help you solve your problem.
how do we get that data back? But just a heads up we are currently downsizing .
We understand your situation. Do you know that you also lost more than 100 GB of data?
That could be possible
Would you like us to provide you with a list of these files?
Sure
do you have that list of files?
We'll upload it to you now. For privacy reasons, we have not made an announcement on our blog yet.
tree.zip filesize:255819
You can select 3 files that are not too large so that we can provide confirmation.
│ │ │ │ ├── 7 - Tender Submission │ │ │ │ │ ├── [redacted] - Terms & Conditions.pdf
│ │ │ │ ├── 6 - Drawings - DXF │ │ │ │ │ ├── OD10 ID4.53 P4.5 T0.375 1598656583.dxf
Tunneling Co - Shroud Assembly_210514.3 │ │ │ │ └── 1 - Screw Conveyor Quote Documents- GP MFG │ │ │ │ ├── 2 - Tender Documents │ │ │ │ │ ├── Shroud Assembly.PDF
[redacted].pdf filesize:53419
OD10 ID4.53 P4.5 T0.375 1598656583.dxf filesize:500
Shroud Assembly.PDF filesize:849082
how did you guys get in our network?
The price is 400 000$. Payment in BTC.
We cant go that high but Ill talk to my boss
We will be waiting for your word.
Hello
We were talking on the tox
Are you here????
Hello are you here?
Hello, I want to pay but don’t have what your asking
Hello. You have not yet made a counteroffer to us. How much are you willing to pay?
15k
I mean, what kind of serious offer are you ready to make? 15k this is not a serious conversation.
Again I don’t have 200k you saw what we have, you have seen it all, you know I’m not lying, there is no way that I can come up with such amount
We barely survive. We haven’t paid paychecks for two weeks you hacked the network you saw it all you saw all of our financials.
There is no way I can bring 200k not even remotely close to it
The amount that you were told is 400k and not 200k
Ha?! 400k??? Sir there is no way on this planet that I can come up with such amount of cash, I cannot get near this number no matter how long this chat will be
If you’re locked on 400k then I’m out of options here, I’ll use old back and try to survive with them
We have reviewed your network and studied your company. Based on this information, we have calculated the amount. If you would like to propose another amount, it should be reasonable, not $15k.
You’re kidding me right? If you seen it all and really studying our financials, you would never come up with such amount something that we don’t have access to no matter what we will do, All of our credit cards are maxed out and we are negative in all bank accounts you hacked our network you saw it all
We haven’t paid paychecks for 2 weeks due to Cash flow issues
So 400k I don’t have sir.
Then you can offer another adequate amount and we will consider it. Not 15k.
Please tell me what’s your bottom line here
Do you want to offer me a job?
What? Sir, I want to close this today, 15k that’s all I’m able to bring , you saw what we have you have seen it all
Yes, we saw what you have, and based on this we said the price. My management wants us to publish an announcement of this incident and turn on the timer. Tell me the price that I can tell the management. Publishing an announcement creates a lot of problems, especially in such cases. We would like to resolve the issue through negotiations, without a public statement.
Posting the data will not bring 400k to the table you can post it now if you wish, this is most definitely not my concern , what your asking is something I cannot get close to, I don’t have access to the cash your asking, 15k is what I can offer 16k max
Have you searched Google for information about us?
No idea who you guys are, and I really don’t care, I would like to close this today and go separate ways
I want to pay, but what your asking is not realistic
Google it. There is a lot of information about us there. Publishing even an announcement on a blog attracts a lot of attention to the company. Government agencies and special services. We would like to help you avoid problems. We are even ready to reduce the cost to 350k.
Please publish the data. As I said it’s not an issue for me. Please do it now, this will not bring 350k to the table cash that I don’t have access to. I understand that this os your business but what your asking is not in my reality, I cannot even go loans all of our cards are 100% maxed out, you saw it all you hacked our network, you know I don’t lie, I don’t have access to the cash your asking
Please work with me and I’ll pay, but the amount your asking is out of my reach
The amount you mention is also unrealistic. If you want to resolve the issue, name the real amount.
Sir, you have seen our situation, you have seen it all, I don’t have access to funds, 15k-16k is the max I can do, all of our accounts are 100% dry, I used all my savings to survive the covid, and since then our business went down drastically, I’m 2 weeks behind on payroll, you saw it all I don’t lie
No bank will give us a loan in our situation
You can think about ways to solve this problem. You know what we require.
Please reduce the amount and I’ll pay, I will never be able to get to your numbers
Tell me how much you can pay. Not 15k. We have already reduced it from 400k to 350k.
As I said 15-16k again I understand that’s your business but I’m sure you checked and saw our financials you saw it all! There is no way on this planet that I can get to your numbers 15-16k that’s all I can bring I don’t lie and you know it , we are in debt since Covid hit - we never recovered from it
Covid was a long time ago. Now the world has changed and the situation in the world is already different. The amount you name does not correspond to your company. I suggest you Google it again, we have a certain strategy and we stick to it. There are articles confirming this. We will not settle for too small a sum. I think you're pretending you don't understand this.
100k
To close this today and now
The wallet and the amount of BTC have been adjusted to make this payment.
This key will unlock all files and machines here?
Yes. All.
// Analysis
Analyst Observations
- This transcript documents a Dragonforce ransomware negotiation. The exchange provides insight into the group's negotiation tactics and communication style.
- → DragonForce threat actor profile — TTPs, ransom demands, and active campaigns.