A ransomware affiliate has reportedly adopted a new tactic: posing as a data recovery service to intercept ransom payments from victims. Researchers at GuidePoint Security identified an operation calling itself "Ransom Busters" that contacts ransomware victims before their attacks become public, offering to recover encrypted files and delete stolen data for a significantly lower fee than the original extortion demand.
GuidePoint's Research and Intelligence Team (GRIT) assesses with "moderate confidence" that Ransom Busters is not a legitimate recovery firm but rather a ransomware affiliate working across multiple ransomware-as-a-service (RaaS) operations. This affiliate is believed to be attempting to divert payments away from its criminal partners.
The discovery of Ransom Busters occurred during investigations into attacks linked to DragonForce, Settra, and Anubis ransomware. Ransom Busters would email victims, claiming to have infiltrated the ransomware gangs themselves and located the victims' stolen data on the attackers' servers.
The purported recovery service offered to delete this data and provide encryption keys for a price ranging from $20,000 to $60,000. Notably, Ransom Busters demonstrated access to the same datasets held by the ransomware affiliate responsible for the initial attacks, raising initial suspicions.
Further forensic analysis revealed a set of specific and unusual fingerprints across two incidents where Ransom Busters approached victims. Both intrusions utilized SoftPerfect Network Scanner for reconnaissance, s5cmd for exfiltrating data to AWS cloud storage, and the Remotely remote-management tool, which was installed via PowerShell.
More conclusively, in both environments, the attacker created a local backdoor account with the password "Numlock!123." The same attacker-controlled hostname, "DESKTOP-BBETH6K," was also observed in both intrusions. While such commonalities could potentially be attributed to ransomware operators sharing tools or prebuilt attack environments, GuidePoint's observation of this activity across several distinct RaaS programs led them to conclude that a single affiliate is likely operating independently across multiple gangs and then cutting out its employers from the ransom payments.
GuidePoint also cautioned that engaging with these purported rescuers offers no guarantee that stolen information will actually be deleted. The researchers advise victims to be wary if an unknown entity contacts them about a ransomware incident before the victim has publicly disclosed it, especially if the offer involves a significantly reduced payment. Such an unsolicited approach may indicate the "rescuer" has inside knowledge of the attack.
