Ransomware negotiation(s) with  dragonforce



Avatar

We found your note. What did you do to our systems?

2024-03-03T21:21:19.66197Z

tree.7z filesize:895892

2024-03-03T23:12:15.145191Z
Avatar

List of files that we downloaded from your corporate network.

2024-03-03T23:12:42.332673Z
Avatar

At the first stage, you can select 1-3 files to ensure that we have them. At the second stage, you should check our decryption program. On the chat page, you will be able to get acquainted with our FAQ.

2024-03-03T23:15:30.775125Z
Avatar

In your server at 192.168.3.11, we used TrueCrypt. If you want to save your data, then don't touch the hard drive. And if we agree, you will have the opportunity to restore all the data.

2024-03-03T23:17:20.910704Z
Avatar
Avatar

Thank you for the tree. I will provide that to our leadership. While we are communicating with you, can you please remove our name from your blog?

2024-03-04T14:23:30.693707Z

ok.

2024-03-04T16:48:22.716208Z
Avatar
Avatar

Leadership is reviewing the tree and will select the files to send you. What is this going to cost us?

2024-03-05T12:01:01.841829Z

The price for decrypting and deleting your files from our servers is 60 BTC. If a quick payment is made, I will discuss with my colleagues a discount for your company.

2024-03-05T12:06:16.806154Z
Avatar
Avatar

Here are the files that leadership selected:

2024-03-06T12:09:19.05468Z
Avatar

Service Centers are Closed Due to Bad Weather.doc Walking Results 2005-3.doc Q2 2023 ATA_ ECON_Webinar.pdf ERY driving directions.xls Buffalo Bid April 2015.xls

2024-03-06T12:09:27.060268Z

ok, wait.

2024-03-06T12:40:39.268828Z
Avatar

files.7z filesize:1097058

2024-03-06T13:06:06.701694Z
Avatar

If you expect a good discount, then you should speed up your negotiations with us. Have you received the files?

2024-03-07T09:45:31.034369Z
Avatar
Avatar

We just received them. I will give them to leadership and we will be in touch shortly

2024-03-07T13:14:06.771753Z

Ok.

2024-03-07T13:15:35.382451Z
Avatar
Avatar

Are we able to test your tool?

2024-03-08T13:40:01.285308Z

Yes, you do have the opportunity to do this.

2024-03-08T13:41:33.413591Z
Avatar

You are on the test decryption page (Stage 2), you can upload the file and it will be decrypted automatically.

2024-03-08T13:42:39.937086Z
Avatar
Avatar

Ok thank you. Our MSP has left for the day and now that it is the weekend he will not return until Monday. Can we test it then please. We know your time is valuable and we are not trying to waste it.

2024-03-08T19:16:20.422622Z

We will extend the deadline, but please keep in mind that if we do not start more meaningful negotiations next week, we will not wait for you. See you on Monday.

2024-03-08T19:34:30.841203Z
Avatar
Avatar

For some reason, we are having an issue with testing the file on your free test on the other page. We will keep trying, but I have the files here as well: https://dropmefiles.com/zj0I7

2024-03-11T12:53:12.749047Z

Ok. Wait.

2024-03-11T12:53:48.507848Z
Avatar

[Redacted] Samples.7z filesize:1468

2024-03-11T13:19:39.08864Z
Avatar

Perhaps publishing on our excellent blog will expedite the negotiation process with you?

2024-03-12T13:04:34.394063Z
Avatar
Avatar

There is no need to publish anything. We have been experiencing network connectivity issues throughout and all information must be relayed to my leadership. This takes some time. I will be back in touch very soon.

2024-03-12T13:24:04.48202Z

ok.

2024-03-12T13:24:42.456459Z
Avatar
Avatar

Our board requires 100% unanimous voting in able for us to move forward with you. We have one member who is not scheduled to return until Monday. We do want to come to a resolution with you. We know that your time is very valuable and we just want to show complete visibility and communication letting you know that we are trying on our end. Please do not release any of our data until after our board can meet.

2024-03-13T14:48:06.492867Z

Agreed, we await Monday.

2024-03-13T16:01:52.217105Z
Avatar
Avatar

Thank you.

2024-03-14T11:45:22.953916Z

This information is provided by Valéry Marchive