A suspected ransomware affiliate is reportedly posing as a recovery service called "Ransom Busters," contacting victims of cyberattacks before the incidents become public. This group claims to possess decryption keys and the ability to delete stolen data for a fee, ranging from $20,000 to $60,000.
GuidePoint Security's Research and Intelligence Team (GRIT) uncovered this activity after responding to multiple recent ransomware attacks where victims received unsolicited emails from Ransom Busters. The suspicious timing of these messages, preceding public disclosure of the attacks, raised questions about how Ransom Busters obtained knowledge of the incidents.
Ransom Busters asserts it exploits vulnerabilities in administrative panels used by ransomware-as-a-service (RaaS) operations, thereby gaining access to encryption keys and victim data. The group offers to delete stolen data from servers associated with various ransomware operations, including DragonForce, Settra, and Anubis.
However, evidence from two separate incidents has led GRIT to conclude that Ransom Busters is likely not a legitimate recovery firm but rather the ransomware affiliate responsible for the attacks. In both cases, the attackers utilized identical software, specifically SoftPerfect Network Scanner, s5cmd, and the Remotely remote monitoring tool. They also employed consistent tactics, such as creating a local backdoor account with the password 'Numlock!123' and using the same attacker-controlled hostname, 'DESKTOP-BBETH6K'.
GRIT has observed overlapping activity across multiple RaaS operations and believes, with moderate confidence, that Ransom Busters is a single ransomware affiliate attempting to divert ransom payments from the gangs they collaborate with. While GRIT has not seen any victims pay Ransom Busters, they strongly advise against doing so. In one instance, a victim instead paid the legitimate RaaS operation, and their name and stolen data were not subsequently published on the ransomware operation's data leak site. GRIT found no evidence that Ransom Busters leaked the stolen data outside the RaaS environment in this case.
Ransomware negotiation firm Coveware confirmed encountering at least one incident where a similar group or individual contacted a victim via email, claiming access to both the decryption key and stolen data. Coveware has observed comparable "middlemen" operating under different names as far back as 2024, but distinguishes this activity from typical "ambulance chasers" who only contact victims after public disclosure.
The involvement of a rogue party with access to stolen data in non-public incidents is considered more concerning. Such interference increases risk for victims, as paying the original ransomware operation may no longer guarantee that all parties with access to the data will honor a non-leakage agreement. This behavior is seen as a potential consequence of increased distrust within RaaS operations, with affiliates seeking to generate additional profits outside of standard revenue-sharing models.
