Ransomware negotiation(s) with  dragonforce



Avatar

I can't tell what the files are and I decrypted a tmp file. I can't verify the decryptor worked on a temp file.

2024-11-13T14:01:37.165091Z
Avatar

I figured out what kind of file it was.

2024-11-13T14:14:40.297382Z
Avatar

What is the amount expected to pay?

2024-11-13T14:17:09.698764Z
Avatar

23 BTC?

2024-11-13T14:40:04.607786Z

Hello. You've been attacked by DragonForce as you can see. We've researched information about your company and decided to set a price of $4,000,000. Otherwise your data will be published in our blog.

2024-11-13T14:40:05.862227Z
Avatar
Avatar

We are a small company, $4 million would bankrupt us.

2024-11-13T14:40:40.423563Z

We don't think so.

2024-11-14T10:43:41.085841Z
Avatar

list.zip filesize:1176161

2024-11-14T10:43:56.150011Z
Avatar

There's a list of what we have. You can choose 2-3 files and we'll send them as proof.

2024-11-14T10:44:56.810606Z
Avatar

Also please note that your decryption key will be automatically deleted in 11 days and 14 hours, so don't waste your time.

2024-11-15T23:09:54.037625Z
Avatar
Avatar

Can you send these three files?

2024-11-16T18:40:09.655957Z
Avatar

FEB2022 | | | | JIT'd2-17-2022.pdf +---PC fixes | | | HP Elitebook USB problems.docx Parts put in inspection.xlsx

2024-11-16T18:40:12.464663Z

Sure.

2024-11-16T18:50:23.969034Z
Avatar

[redacted].zip filesize:1102811

2024-11-16T22:53:20.093131Z
Avatar
Avatar

Thank you. Your note says you will decrypt some files to confirm your decryptor works. Can you decrypt these files?

2024-11-19T16:27:31.247521Z

[redacted].zip filesize:54331

2024-11-19T17:12:06.066056Z
Avatar
Avatar

We would like to come to an agreement with you but there is no way we will be able to come up with the large amount you are asking. Please understand that we have lost a lot of money due to your attack. What discount can you provide us so that we can come to an agreement with you and put this matter behind us?

2024-11-19T19:13:26.683737Z

If you pay quickly, we can provide a 10% discount.

2024-11-19T19:36:25.281237Z
Avatar

We need an update.

2024-11-21T13:58:54.071465Z
Avatar
Avatar

Finn Corporation is a small rust-belt manufacturer that has been hard hit with recent inflation and increased manufacturing costs. We were struggling financially before your attack, and losing access to our computer systems has put us into a crisis. We have very limited access to cash, and our bank has backed away from our company due to this incident. We can offer you $25,000 for your encryption tool, and hope that we can come to an agreement, so that our company can continue to stay in business.

2024-11-21T18:00:24.513570Z

No way.

2024-11-22T00:37:55.499815Z
Avatar

We won't respond again until we see a 7-digit offer.

2024-11-22T00:44:08.352771Z
Avatar
Avatar

Our company does not have the resources to make a seven-digit payment. This attack has caused significant hardship to us. Please reconsider your position. This company employs 58 people, and these jobs will be lost if we cannot recover our operations. Hardship will fall upon them, and their families and children. We do not want these innocent people to suffer, and we hope you feel the same way. We are actively reaching out to our friends and family this weekend to try to raise additional funds. If we can get to a $125,000 payment, could we resolve this very difficult situation?

2024-11-24T20:14:00.961417Z

Stop lying, it's not that bad. We can solve it, but not for $125,000.

2024-11-25T15:30:18.396299Z
Avatar
Avatar

We have been able to raise $187,000 over the weekend and have this amount available to pay now. Please let us know if we can pay this amount for your decryption tool to put this matter behind us before the Thanksgiving holiday.

2024-11-25T23:13:39.128573Z

We have added 2 more days for you. We're waiting for a good offer.

2024-11-26T03:13:01.132162Z
Avatar

Thanks, but no. You have around 2 days to collect money.

2024-11-27T19:27:12.814672Z
Avatar

Guys, today is the last day, we will publish your blog tomorrow. What you got after the weekend?

2024-12-05T18:08:19.882428Z
Avatar

This information is provided by Valéry Marchive & Julien Mousqueton