Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business

Negotiation Chat – Dragonforce

Chat ID: 47862256EB69DC71

Victim Avatar
We’ve found your note and messages, and we are here to discuss what we do now
2025-04-10T21:20:45.774561Z
We got into your network and encrypted your files. We also took some of the files from your network. You can decrypt several of your files and check several files in our possession. After that, we will discuss payment for decrypting your files and deleting the data we received.
2025-04-11T00:35:49.938260Z
Gang Avatar
Here is a list of your files
2025-04-11T00:36:27.750221Z
Gang Avatar
Victim Avatar
Is this listing all of the data you stole? How much is it total in size?
2025-04-11T21:05:13.106683Z
More than 100 gigabytes, more than 50 thousand files.
2025-04-11T21:07:50.211371Z
Gang Avatar
Victim Avatar
We want these files from your list: Group\\Clients\\[redacted]\\[redacted]\\[redacted].pdf Collateral Review\\Template v2022-08\\[redacted].xlsm [redacted].pdf
2025-04-14T22:05:27.140521Z
You can see the countdown timer. When it reaches 0, the data will be published, and the decryption tool will be deleted. Some promise to recover the data after our encryption, but this is not possible. Trying to negotiate just before the countdown ends will not make the position strong. Keep this in mind and don't miss the time.
2025-04-17T21:52:57.374172Z
Gang Avatar
Victim Avatar
How are we supposed to negotiate anything or attempt to move forward here when you haven't even told us your price? What exactly is it you want from us?
2025-04-18T18:55:29.118725Z
You saw the rules right away. Listing, test, price. The price is 12 BTC.
2025-04-18T19:28:58.117337Z
Gang Avatar
In the absence of active negotiations, the data will be published in less than 48 hours.
2025-04-22T21:41:50.776077Z
Gang Avatar