SECURITY Signal 450
Fake recovery firm Ransom Busters reportedly a ransomware affiliate undercutting its own gangs
↗
GuidePoint Security reports that Ransom Busters, a group contacting ransomware victims with recovery offers, is likely a ransomware affiliate trying to steal payments from its own criminal partners.
Victims who pay the supposed recovery firm get no guarantee their data will be deleted, and the scam shows that even ransomware gangs can't trust their affiliates. Security teams should treat unsolicited recovery offers as suspicious and verify any contact against known attack patterns.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Ransom Busters contacts victims before attacks go public, offering to delete stolen data and recover encryption keys for $20,000 to $60,000.
GuidePoint assesses with moderate confidence that Ransom Busters is a ransomware affiliate working across multiple ransomware-as-a-service operations.
Forensic evidence, including a shared backdoor password and hostname, links the recovery firm to the original intrusions.
THE CLUSTER