Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Negotiation Chat — Dragonforce

Return to Dragonforce
Negotiation chats provided by Valéry Marchive and Julien Mousqueton.

Chat ID: 1e4a1771-ca8e-498c-a961-6e20180c091d

Initial Ransom
$1,269,725
Negotiated Ransom
$1,000,000
Ransom Paid
N/A
Victim
You have our attention now and are following your instructions. Please confirm you will communicate with us only on here.
2025-11-21T15:55:21.808975Z
We confirm.
2025-11-21T16:53:30.771867Z
Gang
[attachment: UPAL.txt (0 bytes)]
2025-11-21T17:24:03.679679Z
Gang
Below is the file tree of the files we stole from you,you can select up to 3 files from this list and we will send them to you as proof that we have them
2025-11-21T17:25:52.267774Z
Gang
[attachment: UPAL.txt (0 bytes)]
2025-11-21T17:25:54.753933Z
Gang
[attachment: UPAL.txt (0 bytes)]
2025-11-21T17:28:07.806215Z
Gang
https://www.filemail.com/d/extulzbothgmcal
2025-11-21T17:30:40.779969Z
Gang
You can also decrypt 3 files for free in this page as decryption proof
2025-11-21T17:31:25.603647Z
Gang
Hello, This message is sent incase we are not online at the time of your arrival tomorrow, The process works like this : 1 - You read the FAQ page available in this link. 2 - You Unlock the 3 test files using the auto decryptor OR by sending it to us for manual decryption. 3 - You check the file tree of all the stolen files sent to you, and you can ask for 3 files from the list to be sent to you as proof so you can confirm we actually are in position of the files listed in the .txt file. The price set by our team for Unipres Alabama, Inc. is "15 Bitcoins". After payment is made, you will receive : Universal Decryptor for all the locked machines ( WINDOWS - ESXI - NAS and so on ) Proof of deletion of your files from our servers A write up on how this incident happened ( The initial access, encryption and exfiltration process ) Guarantee that Dragon Force will never target you again. In case of any questions, you can still contact us here. Best regards.
2025-11-22T00:53:40.584762Z
Gang
Victim
Thank you for the listing, we are sharing this for our team to review and asked them to gather what’s needed for your tool. Thank you for your patience. we'll send the file names and the encrypted files to you for testing.
2025-11-22T17:59:07.976914Z
No worries, We'll be waiting for you
2025-11-22T18:02:34.04792Z
Gang
Hello, are you ready to make your 3 requests?
2025-11-24T19:09:05.874133Z
Gang
Victim
We want to continue our conversation, but we will only communicate with you through this channel. Please confirm you will stop calling and emailing our employees directly or we won't be able to continue this discussion. You have our attention, but no one else is authorized to talk to you. We also wanted to explain that It's taking us some time to review the file list you sent, but we have selected the following as you instructed: 23090.pdf, Q2 Logistics Fee Detail.xlsx, Blair Approval - Passport Repair.pdf. We will need some more time to finish this review.
2025-11-25T21:49:57.3445Z
Hello sorry we had some server issues,We will send the requested files below and yes we conform to only talk through here but you have to cooperate
2025-11-25T23:25:15.066262Z
Gang
[attachment: Blair Approval - Passport Repair.pdf (92390 bytes)]
2025-11-25T23:25:29.579221Z
Gang
[attachment: 23090.pdf (80778 bytes)]
2025-11-25T23:25:34.757379Z
Gang
[attachment: Q2 Logistics Fee Detail.xlsx (535722 bytes)]
2025-11-25T23:26:23.455363Z
Gang
Greetings, If you need help with anything else today let us know. ( you still haven't used your 3 test files decryptions )
2025-11-26T15:06:26.881079Z
Gang
With the holidays around the corner, whenever you are done checking the file tree, we'd like to know Unipres's stance about the situation. if we'll reach an agreement.
2025-11-26T18:13:33.151779Z
Gang
Victim
Thank you for the confirmation and providing the files. We are waiting on some internal approvals to proceed with next steps, but please understand that we are having some delays due to the holiday weekend, we will get back to you Monday to proceed.
2025-11-26T22:45:02.884524Z
No worries, We'll be waiting for you
2025-11-27T00:24:12.8853Z
Gang
Greetings, hope you had a great holiday. We'll be waiting for you to proceed with the next steps this week. best regards.
2025-11-30T14:36:51.999465Z
Gang
Hello, welcome back to the chat. Will you be testing our decryption tool? if not we can go to the next step which is the payment. in that case we'll have to create the payment page for you so I need your confirmation.
2025-12-01T18:11:36.96895Z
Gang
Victim
Thank you for waiting while we sorted out all of the approvals for next steps over the holiday weekend. We are sending you test files for decryption momentarily.
2025-12-01T23:50:39.381537Z
Victim
[attachment: 4kdugd2tzqvnh47tlypaktoyeijfn3wmmi7apam5crpan3oyeil5mbyitz.df_nas (1875 bytes)]
2025-12-01T23:55:53.096624Z
Victim
[attachment: 4npan6ryeidfn3crmvu4jdzkcyjxw4rnh5yir5cvmx5auxkqhuh2w4rkcxrftkcwmve2ydzpp2jquinkevfi22wfmfvdtdt3vnhdy5ugjimin3cjmi7dqamyueunebyj.df_nas (0 bytes)]
2025-12-01T23:56:08.097968Z
Victim
[attachment: 6emj34ygzksvaw2hzsegax2jieunebyjr3.df_nas (12759 bytes)]
2025-12-01T23:56:36.655778Z
Victim
[attachment: 4npan6ryeidfn3crmvu4jdzkcyjxw4rnh5yir5cvmx5auxkqhuh2w4rkcxrftkcwmve2ydzpp2jquinkevfi22wfmfvdtdt3vnhdy5ugjimin3cjmi7dqamyueunebyj.df_nas (0 bytes)]
2025-12-01T23:56:54.896305Z
[attachment: Assembly - ショートカット.lnk.download (819 bytes)]
2025-12-02T05:36:16.006079Z
Gang
[attachment: T90 failure list.xlsx (11703 bytes)]
2025-12-02T05:36:20.247788Z
Gang
Decrypted files sent, we've also added 1 day to your timer since we were away yesterday as a token of appreciation for your cooperation. whenever you are online we continue the process.
2025-12-02T05:58:42.699334Z
Gang
I believe the work hours are past us and we've been left in the dark about the next step of the process. may I remind you that you are on a time limit? the moment the timer hits 0 your files will be pubished automatically and your decryptor will be deleted as well.
2025-12-03T00:18:26.911607Z
Gang
Victim
Thank you for extending the timer, we see you are as committed to sorting this out as we are. We downloaded the two files you sent, but it seems like the third one didn't upload. Maybe it was too big? I'm asking for a different file to send you so we can finish up this process.
2025-12-03T00:52:06.186816Z
Hello there, upload does bug out if the file size is too big ( The maximum acceptable size is 4MB for test files ), you can upload the last file on Filemail.com and we'll download it no problem, but if it is over 4MB I kindly ask you to select another file and not wait until after working hours in the future days because just like you, we have work hours as well and we won't be working overtime everyday to make sure we catch you being online. thanks in advance.
2025-12-03T07:26:12.49763Z
Gang
Victim
[attachment: qehz3sboqehrgama6yvpkwldtida3w64e3mzgam3yxwk5hrssc25ffzzsxhqfwh.df_nas (1796 bytes)]
2025-12-03T22:35:08.043919Z
Victim
I just wanted to let you know that I completely understand you have your own schedule and priorities. We're also doing our best to move things along as quickly as possible, but everything needs to go through a review and approval process first. I’ve attached a third alternative file for decryption whenever you have a moment. Thank you so much for your patience and assistance.file
2025-12-03T22:35:16.072802Z
[attachment: 20211210_WS_Kepware_A40_Disabled.pcapng (740 bytes)]
2025-12-03T22:36:47.326332Z
Gang
Your last file decrypted and sent, I understand that everything has to be going through a review and approval. I've added 2 more days to your timer now and I would like to thank you for your cooperation and communication. Hope we can make good progress tomorrow.
2025-12-03T22:38:24.592069Z
Gang
Victim
Thank you for sending the file and for extending the deadline. I appreciate your flexibility and willingness to work with us. We are reviewing what you have provided us, and will follow up as quickly as we can.
2025-12-04T18:20:17.277052Z
We'll hopefuly hear from you later today since we know for a fact our decryption is flawless. Regarding the next step, with the weekend coming up we'd like to know when to expect the payment. the decryption software and deletation of your files from our servers are both automated, the second the payment gets confirmed on the blockchain you'll be given the decryption tools and the files will also automatically be deleted from our servers, so no need to worry about that step even during weekends etc it'll be done automatically.
2025-12-04T18:30:08.644444Z
Gang
Victim
We really appreciate you working with us. While we understand that your original payment ask was 15 BTC, we currently don’t have that kind of cash on hand to reach that number. Would you be willing to work with us on the pricing? We genuinely want to resolve this and reach an agreement. In the meantime, we want to assure you that we are doing everything we can on our end to find more cash. We have a meeting with our bank on Monday to see what funds we are approved for. Could you please extend the timer to the end of next week so we don’t get automatically posted while we are getting the funding approved? We are expediting the process as much as we can on our side and will keep you updated on our progress. I hope our good faith communication so far shows that we are serious about engaging with you.
2025-12-05T20:34:42.672588Z
Hello there, allow me a second to check this case for you
2025-12-05T20:35:28.583952Z
Gang
I've checked the numbers and ran them by our team, we can have a deal on 1,200,000 USD fixed rate. that's around 11% discount for your case. We've already given you a lower initial price than normal, ( Normal cases would be around 1.8M - 2M in your revenue range with insurance and etc ) so further discounts will not be happening. and we've gone ahead and extended the timer for you until 11th of December. We expect your mother company and your insurance chipping in for your lack of cash and we can put this incident behind us in no time. We expect an update about your cash situation next week at least every 2 days, and if you need more time than 11th of December you can contact us later and we'll consider. Hopefully we can close out this deal without problems. best regards
2025-12-05T21:19:13.232463Z
Gang
Victim
Thank you for extending the timer and providing us the discount. We really appreciate it. We will discuss internally regarding this and get back to you.
2025-12-08T22:38:54.432174Z
We'd like to close this out this week, waiting to hear back from you.
2025-12-08T22:50:32.26789Z
Gang
Hello, your time is running low let me know and I'll increase it by 2 days if you need more time. We'd like to come to an agreement on the price TODAY, so we can close this deal this week maximum. let us know the result of the internal dicussions as soon as possible.
2025-12-10T09:10:59.042243Z
Gang
I've added a day to your timer since I know you'll be looking to negotiate a deal with us. We are waiting to hear from you so we can close a deal this week or maximum next week. thanks in advance for your cooperation!
2025-12-11T00:45:14.641419Z
Gang
Victim
Thanks for your patience. We have held several emergency meetings with our leadership and finance teams to expedite the process, but we are having difficulties getting bank authorization for the full amount of 1.2 million by the end of the week. Please extend the timer as it would be helpful. To move things along faster, we could focus instead on getting approval for one of your services instead. Could you please share the pricing for each service?
2025-12-11T15:09:40.514559Z
We don't do "each service", If you need decryption service or not, the price will be still included because at the end of the day we give you everything in full. that being said, I've talked to our team and dropped your price to 1,050,000 USD a sign of good will to close this out in before Christmas for you. I've added one more day to the timer for you now. we'd appreciate a response by the end of today on if the current price is suitable for you to close the deal as soon as possible! Best regards
2025-12-11T15:13:54.185682Z
Gang
Hello, We'll help you however we can to close this deal as soon as possible.
2025-12-12T13:29:09.406772Z
Gang
Victim
Thank you for being flexible with the amount, but it's still a lot of money, and we can't get it approved by the end of this week. We're taking your offer seriously and considering the next steps, but our Chairman and President, who are key decision-makers, are currently overseas for an executive meeting and aren’t reachable right now. Since they won’t return to the U.S. until Monday, we’ll need a bit more time to sort things out. We get that you don’t offer separate pricing for each service, although we hoped that might speed things up. We’ll update you by Tuesday after we’ve had a chance to go over everything with them.
2025-12-12T15:29:25.638987Z
We understand your situation. I've dropped your price to 1,000,000 USD. from this point our windows for discounts are super tight. I've also increased the time till Thursday this week. Hopefuly we can close this around that date once and for all! Thanks for your cooperation and communication.
2025-12-12T16:21:50.89644Z
Gang
Hello, Hope you had enough time to discuss the outcome of our negotiations and our deal. Let us know how and when you'll proceed for the payment. We'd like to close this matter this week. I've added one more day to your timer. Best regards, DragonForce
2025-12-16T14:24:36.485998Z
Gang
http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog?post_uuid=1e4a1771-ca8e-498c-a961-6e20180c091d
2025-12-18T14:50:05.145237Z
Gang
In case you think we aren't serious, this post is currently PRIVATE, in 24 hours it'll be visible for public and in 24 hour after that EVERYTHING will be published. If we didn't give you the extra 1 day you'd be published today.
2025-12-18T14:50:48.556578Z
Gang