A suspected ransomware affiliate is reportedly posing as a data recovery service, "Ransom Busters," contacting victims of cyberattacks before the incidents become public. The group claims to possess decryption keys and the ability to delete stolen data for a fee, ranging from $20,000 to $60,000.
GuidePoint Security's Research and Intelligence Team (GRIT) uncovered this activity after responding to multiple ransomware attacks where victims received unsolicited emails from Ransom Busters. The early contact raised suspicions about how the group gained knowledge of non-public cyberattacks.
Ransom Busters asserts it exploits vulnerabilities in the administrative panels of ransomware-as-a-service (RaaS) operations, granting it access to encryption keys and victim data. The group offered to delete stolen data from servers associated with RaaS operations such as DragonForce, Settra, and Anubis.
However, GRIT's analysis of two separate incidents suggests Ransom Busters is not a legitimate recovery firm but rather the ransomware affiliate responsible for the attacks. In both cases, the attackers utilized the same software, including SoftPerfect Network Scanner, s5cmd, and the Remotely remote monitoring tool. They also consistently created a local backdoor account with the password 'Numlock!123' and used the attacker-controlled hostname 'DESKTOP-BBETH6K'.
GRIT observed overlapping activity across various RaaS operations, leading them to believe with moderate confidence that Ransom Busters is a single ransomware affiliate attempting to divert ransom payments from the gangs it collaborates with. As of mid-August 2026, GRIT has not seen any victims pay Ransom Busters and advises against doing so.
In one incident, a victim contacted by Ransom Busters instead paid the underlying RaaS operation. Subsequently, the victim's name and stolen data were not published on the ransomware operation's data leak site, and GRIT found no evidence that Ransom Busters leaked the data outside the RaaS environment.
Ransomware negotiation firm Coveware confirmed encountering at least one incident where the same group or individual contacted a victim via email, claiming access to both the decryption key and stolen data. Coveware noted similar "middlemen" using different names as far back as 2024, but distinguishes Ransom Busters' activity from typical "ambulance chasers" who only contact victims after public disclosure.
Coveware views this interference in non-public incidents as particularly concerning. They suggest that a rogue party with access to stolen data increases risk for victims, as paying the original ransomware operation may no longer guarantee that all parties with access will honor an agreement not to leak the data. The firm speculates that increased distrust within RaaS operations could drive more affiliates to seek additional profits outside of standard revenue-sharing arrangements.
