Target Details

Target Info - CareFirst Medical Group

Update
NameCareFirst Medical Group
Created At2025-12-18 09:30:00
DescriptionMulti-specialty clinic network with 45 locations. EMR system critical, 200k+ patient records.
TimezoneAmerica/Chicago
Zoom InfoDaily sync: 15:00 CST
Contactsecure.channel.002@tutanota.com
Duration48h
Requested$150000
In BTC2.1429 BTC
Address own
Status In Progress
Additional Services
Access to legal experts familiar with international law
Professional crypto mixing and laundering assistance

Target Chat

Tox: A34860C6C49509970335...
Operator Attention Midwest Manufacturing Inc. Your production systems have been encrypted. We have exfiltrated 450GB of sensitive data including customer contracts, financial records, and proprietary designs. Payment: 75 BTC. Timer starts now. 2025-12-10 06:00:00
CEO Who is this? Our entire factory floor is shut down. We have orders to fulfill. What data do you have? 2025-12-10 09:15:00
Operator Proof attached: sample of your Q4 financial projections, list of your top 50 customers, CAD files for your new product line. We publish everything in 5 days if no payment. 2025-12-10 10:00:00
Legal Counsel We are engaging with you under advice of counsel. We need assurances that data will be deleted upon payment. Also, 75 BTC is excessive for a company our size. 2025-12-10 14:30:00
Operator We always delete after payment. Check our reputation - we are professionals. Price adjusted to 45 BTC given your revenues. Non-negotiable. Time is money. 2025-12-10 16:00:00
CEO We are prepared to pay 30 BTC. Our insurance covers 20, we can source the remaining 10. This is our maximum capacity. 2025-12-11 08:00:00

Support Chat

Encrypted
DragonForce System Target assigned: CareFirst Medical Group 2025-12-18 09:30:00
op_shadow EMR system access obtained. 45 clinic locations mapped. Deploying encryptor to central servers. 2025-12-18 15:00:00
DragonForce Support Approved for deployment. Target during off-hours for maximum impact. 2025-12-19 08:00:00
op_shadow Encryption started 22:00 UTC. 200GB patient data in progress. 2025-12-19 22:30:00
DragonForce System Encryption 60% complete. Target systems responding to ransom note. 2025-12-20 01:15:00
op_shadow Encryption complete. All 45 clinics offline. Ransom note deployed. Awaiting contact. 2025-12-20 04:00:00

Windows Builds

Create Encryptor for Target

No binaries generated for this target yet.

Click "Create Encryptor for Target" to generate a custom ransomware binary.

Custom Ransom Note

ATTENTION: CAREFIRST MEDICAL GROUP

Your patient records, imaging systems, and EMR databases have been encrypted.

HIPAA violations will be publicly disclosed if payment is not received.

Price: $150000 in Bitcoin
Deadline: 48 hours
Payment Address: [SEE SECURE PORTAL]

Further delay will result in public release of patient PHI data.

DO NOT contact law enforcement or security firms.
DO NOT attempt recovery - backups are also encrypted.

Contact us via the secure communication channel for payment instructions.
This custom ransom note will be embedded in binaries created for this target.