Ransomware note ransomware-note
ransomware-note Dragonforce .xt readme.xt note-dragonforce-readme-xt Ransomware note Dragonforce — readme.xt

Archived note body

Plain text · original whitespace retained

Source and hash

Good afternoon, 

As you can see you have been attacked by a ransomware program! We The DragonForce Ransomware Cartel offer you to make a deal with us. We can make a deal with you, all you need to do is contact us by following the instructions below. 
We are in no way connected to politics, we always keep our word. You have a chance to decrypt your files and avoid being published on our blog! Use this opportunity and also don't waste your time. 
The approximate date of deletion of the decryptor program, as well as publication on our blog 26/04/2025 00:00 UTC.

- # 1 Communication Process, 

	In order to contact us you need to click on the special link below, which is listed in #2. 
	After that the negotiation process begins, in which you have the opportunity to request several things from us, 
		
		1. make a test decrypt.
		2. get a list of the files stolen from you.
		
	At the conclusion of our negotiations we agree on a price, we set the price ourselves based on your income/your insurance. 
	We scrutinize your documents and are well aware of how much income your company has per year.

- # 2 Access to the meeting room, 

	To access us please download Tor Browser which is available here. (https://www.torproject.org/)
	Once you download the special anonymous browser you need to follow this link, http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
	Your unique ID: [snap] - use it to enter our meeting room. 

- # 3 Additional Support Contacts, 

	Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20

- # 4 Recommendations, 

	Do not try to recover your files with third-party programs, you will only do harm.
	Do not turn off / reboot your computer.
	Be courteous in our meeting room. 
	Do not procrastinate. 

- # 5 Blog and News,

	Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
	DragonNews: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news

Related negotiation records

View all 14 records

An explicit alias maps the note family Dragonforce to the Ransomchats actor label Dragonforce. This relationship does not merge either corpus or its statistics.

Up to ten negotiation records from the mapped actor collection
Record IDIndexed dateMessagesThreat actor
058f4b92-ae99-45c7-bf35-5d2d6754b3de Date not recorded 19 Dragonforce
05f724f8-906e-4739-8177-815852cc2c3f Date not recorded 29 Dragonforce
29BBE03074FDBB8D Date not recorded 10 Dragonforce
7A313D13EB6B4E58 Date not recorded 32 Dragonforce
89716D29D2CEE36F Date not recorded 23 Dragonforce
AB0404E049514B50 Date not recorded 28 Dragonforce
b8e14e1a-548f-4eec-bd6e-a590126e57c9 Date not recorded 14 Dragonforce
BD004D632D87DBA0 Date not recorded 25 Dragonforce
C2A3C7249797F5ED Date not recorded 66 Dragonforce
C42CDF65B97D0E92 Date not recorded 30 Dragonforce