A new entity calling itself "Ransom Busters" has reportedly begun contacting victims of ransomware attacks, asserting that it has successfully breached the servers of various ransomware groups. Ransom Busters is subsequently offering to delete the data stolen by these ransomware groups for a fee, which reportedly ranges from $20,000 to $60,000. This development introduces a novel layer to the post-infection landscape for ransomware victims.
Security researchers who have observed this activity are expressing skepticism regarding the claims made by Ransom Busters. The prevailing assessment among these researchers is that Ransom Busters is likely not a legitimate data recovery or deletion service. Instead, it is suspected that this operation could be a ransomware affiliate attempting to further extort victims who have already suffered a primary ransomware attack and data exfiltration.
The technical mechanism behind such an operation, if it were indeed a legitimate breach of ransomware infrastructure, would involve exploiting vulnerabilities within the command-and-control servers or data repositories maintained by ransomware gangs. These servers are typically used to manage victim communications, store exfiltrated data, and distribute decryption keys. However, the current assessment suggests a more opportunistic approach, where an affiliate with access to victim lists and exfiltrated data might simply be leveraging that access for a secondary extortion attempt.
Victims targeted by this scheme are typically those whose data has been exfiltrated during a ransomware attack, a common tactic employed by many modern ransomware groups to increase pressure for payment. The "service" offered by Ransom Busters purports to eliminate this secondary threat of data leakage or sale. However, the lack of verifiable proof of their claims means victims have no assurance that payment would lead to the promised data deletion.
Mitigation guidance for organizations facing ransomware attacks consistently emphasizes robust data backup and recovery strategies, alongside strong network segmentation and endpoint security. In the context of data exfiltration and subsequent extortion attempts, organizations are generally advised against making payments to threat actors, as there is no guarantee that data will be deleted or that further extortion attempts will not follow. Engaging with law enforcement and incident response professionals remains the recommended course of action.
This reported activity by Ransom Busters highlights the evolving tactics within the cyber extortion ecosystem. It represents a potential new vector for monetizing ransomware attacks, moving beyond the initial demand for decryption keys to a secondary market for data deletion. Such schemes underscore the complex challenges organizations face in recovering from and responding to sophisticated cyber incidents, particularly those involving data theft.
