// Ransomware Negotiation Transcript
Dragonforce Ransomware Negotiation — D6Ddd9B26D7D41Db
// Context
About This Negotiation
This transcript documents a Dragonforce ransomware negotiation with D6Ddd9B26D7D41Db. The negotiation consisted of 14 messages exchanged.
The initial ransom demand was $360,000. The negotiation resulted in a confirmed payment.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
We’ve found your note and messages, and we are here to discuss what we do now
We got into your network and encrypted your files. We also took some of the files from your network. You can decrypt several of your files and check several files in our possession. After that, we will discuss payment for decrypting your files and deleting the data we received.
tree.txt filesize:4700442
Here is a list of your files
Is this listing all of the data you stole? How much is it total in size?
More than 100 gigabytes, more than 50 thousand files.
We want these files from your list: Group\Clients\[Redacted].pdf Collateral Review\Template v2022-08\[Redacted].xlsm [Redacted].pdf
[Redacted].pdf filesize:1125386
[Redacted].xlsm filesize:947633
[Redacted].pdf filesize:10588784
You can see the countdown timer. When it reaches 0, the data will be published, and the decryption tool will be deleted. Some promise to recover the data after our encryption, but this is not possible. Trying to negotiate just before the countdown ends will not make the position strong. Keep this in mind and don't miss the time.
How are we supposed to negotiate anything or attempt to move forward here when you haven't even told us your price? What exactly is it you want from us?
You saw the rules right away. Listing, test, price. The price is 12 BTC.
In the absence of active negotiations, the data will be published in less than 48 hours.
// Analysis
Analyst Observations
- The final settlement represented a 0% reduction from the initial demand — a moderate reduction.
- → DragonForce threat actor profile — TTPs, ransom demands, and active campaigns.